SAMPLE REPORT
Illustrative report format only. Not a real customer assessment, a live scan, or proof of current vulnerabilities. All observations and severity labels below are examples.
Example target: testphp.vulnweb.com, Acunetix’s public intentionally vulnerable test application. Test application information.
This preview mirrors Protego’s combined report: prioritized findings, surface scan, AI attack simulation and AI fix prompts. Example highest severity: High. Surface grade: not measured. No test was run for this page.
Actual reports cover only the approved hostname and recorded observations. Automated, unauthenticated testing can miss vulnerabilities and produce false positives. Incomplete coverage is labeled. A clean report does not establish security.
Affected area: /
A response may omit Content-Security-Policy and X-Content-Type-Options.
Impact: Missing browser defenses can increase the impact of other application weaknesses.
Example evidence: Illustrative header review only. No current header values were collected.
Remediation: Set X-Content-Type-Options: nosniff and roll out a tested Content Security Policy.
Affected area: /login.php
A login form served over HTTP can transmit credentials without transport encryption.
Impact: An attacker on the network path could read or modify login traffic.
Example evidence: Illustrative transport finding for an HTTP test application, not a current traffic capture.
Remediation: Serve login and all application pages over HTTPS, redirect HTTP, secure session cookies and enable HSTS after validating HTTPS coverage.
Affected area: /artists.php?artist=
An artist identifier may reach a database query without safe parameter binding.
Impact: An attacker could read or alter database records within the application account’s permissions.
Example evidence: Illustrative observation: changing the identifier causes a database error or changes the returned records. No request was executed to produce this sample.
Remediation: Use parameterized queries, validate identifier types and restrict database account permissions.
Affected area: /search.php
Search input may be reflected into HTML without context-aware output encoding.
Impact: Script could execute in a visitor’s browser if they follow a crafted link or submit crafted input.
Example evidence: Illustrative observation: a harmless input marker appears unescaped in the response. This is an example, not captured scan evidence.
Remediation: Encode output for its HTML context, use safe templates and deploy a restrictive Content Security Policy as defense in depth.
Example developer prompt: Review the artist lookup query for unsafe SQL construction. Replace it with parameter binding, preserve intended behavior and add regression coverage. Validate the finding before changing code.
Actual technical ZIPs include ai-fix-prompts.md for recorded findings. Review suggested fixes before applying them.
Confirm each finding, assign an owner, apply the fix and verify the affected behavior again. Retesting and remediation are not included by default. Actual reports include available evidence and label missing data rather than inventing it.