FailSafe - Web Application Pen Test Findings Report Complete Security Assessment | Passed Performance Assessment 2026.

FailSafe
Security Assessment Findings Report




Business Confidential


Date: June 22nd, 2025
Version 1.0


FailSafe
BUSINESS CONFIDENTIAL Page 1 of 27
Copyright © TCM Security (tcm-sec.com)

,Contents
Confidentiality Statement .............................................................................................................................................. 3
Disclaimer ........................................................................................................................................................................ 3
Contact Information ........................................................................................................................................................ 3
Assessment Overview ..................................................................................................................................................... 4
Assessment Components............................................................................................................................................... 5
Web Application Penetration Test ............................................................................................................... 5
Finding Severity Ratings .............................................................................................................................. 6
Scope.............................................................................................................................................................. 7
Scope Exclusions .......................................................................................................................................... 7
Client Allowances ......................................................................................................................................... 7
Executive Summary ........................................................................................................................................................ 8
Attack Summary ........................................................................................................................................... 8
Security Weaknesses ...................................................................................................................................................... 9
Vulnerabilities by Impact .............................................................................................................................................. 10
Web Application Penetration Test Findings................................................................................................................ 11
Stored Cross-Site Scripting (XSS) – FailSafe Application (High) .......................................................... 11
Insecure Direct Object Reference (IDOR) – FailSafe Application (High) ............................................. 14
Business Logic Flaw (BFLA) – Failsafe Application (High) .................................................................... 17
Broken Object Level Authorization (BOLA) – Failsafe Application (High) ............................................ 22
Additional Findings ........................................................................................................................................................ 24
Appendix A: Attempted But Unsuccessful Attacks .................................................................................................... 26




FailSafe
BUSINESS CONFIDENTIAL
Copyright © TCM Security (tcm-sec.com) Page 2 of 27

, Confidentiality Statement
This document is the exclusive property of FailSafe and TCM Security (TCMS). This document
contains proprietary and confidential information. Duplication, redistribution, or use, in whole or in
part, in any form, requires consent of both FailSafe and TCMS.
TCMS may share this document with auditors under non-disclosure agreements to demonstrate
penetration test requirement compliance.


Disclaimer
A penetration test is considered a snapshot in time. The findings and recommendations reflect the
information gathered during the assessment and not any changes or modifications made outside of
that period.
Time-limited engagements do not allow for a full evaluation of all security controls. TCMS prioritized
the assessment to identify the weakest security controls an attacker would exploit. TCMS
recommends conducting similar assessments on an annual basis by internal or third-party
assessors to ensure the continued success of the controls.


Contact Information





FailSafe
BUSINESS CONFIDENTIAL Page 3 of 27