FailSafe
Security Assessment Findings Report
Business Confidential
Date: June 22nd, 2025
Version 1.0
FailSafe
BUSINESS CONFIDENTIAL Page 1 of 27
Copyright © TCM Security (tcm-sec.com)
,Contents
Confidentiality Statement .............................................................................................................................................. 3
Disclaimer ........................................................................................................................................................................ 3
Contact Information ........................................................................................................................................................ 3
Assessment Overview ..................................................................................................................................................... 4
Assessment Components............................................................................................................................................... 5
Web Application Penetration Test ............................................................................................................... 5
Finding Severity Ratings .............................................................................................................................. 6
Scope.............................................................................................................................................................. 7
Scope Exclusions .......................................................................................................................................... 7
Client Allowances ......................................................................................................................................... 7
Executive Summary ........................................................................................................................................................ 8
Attack Summary ........................................................................................................................................... 8
Security Weaknesses ...................................................................................................................................................... 9
Vulnerabilities by Impact .............................................................................................................................................. 10
Web Application Penetration Test Findings................................................................................................................ 11
Stored Cross-Site Scripting (XSS) – FailSafe Application (High) .......................................................... 11
Insecure Direct Object Reference (IDOR) – FailSafe Application (High) ............................................. 14
Business Logic Flaw (BFLA) – Failsafe Application (High) .................................................................... 17
Broken Object Level Authorization (BOLA) – Failsafe Application (High) ............................................ 22
Additional Findings ........................................................................................................................................................ 24
Appendix A: Attempted But Unsuccessful Attacks .................................................................................................... 26
FailSafe
BUSINESS CONFIDENTIAL
Copyright © TCM Security (tcm-sec.com) Page 2 of 27
, Confidentiality Statement
This document is the exclusive property of FailSafe and TCM Security (TCMS). This document
contains proprietary and confidential information. Duplication, redistribution, or use, in whole or in
part, in any form, requires consent of both FailSafe and TCMS.
TCMS may share this document with auditors under non-disclosure agreements to demonstrate
penetration test requirement compliance.
Disclaimer
A penetration test is considered a snapshot in time. The findings and recommendations reflect the
information gathered during the assessment and not any changes or modifications made outside of
that period.
Time-limited engagements do not allow for a full evaluation of all security controls. TCMS prioritized
the assessment to identify the weakest security controls an attacker would exploit. TCMS
recommends conducting similar assessments on an annual basis by internal or third-party
assessors to ensure the continued success of the controls.
Contact Information
FailSafe
BUSINESS CONFIDENTIAL Page 3 of 27
Security Assessment Findings Report
Business Confidential
Date: June 22nd, 2025
Version 1.0
FailSafe
BUSINESS CONFIDENTIAL Page 1 of 27
Copyright © TCM Security (tcm-sec.com)
,Contents
Confidentiality Statement .............................................................................................................................................. 3
Disclaimer ........................................................................................................................................................................ 3
Contact Information ........................................................................................................................................................ 3
Assessment Overview ..................................................................................................................................................... 4
Assessment Components............................................................................................................................................... 5
Web Application Penetration Test ............................................................................................................... 5
Finding Severity Ratings .............................................................................................................................. 6
Scope.............................................................................................................................................................. 7
Scope Exclusions .......................................................................................................................................... 7
Client Allowances ......................................................................................................................................... 7
Executive Summary ........................................................................................................................................................ 8
Attack Summary ........................................................................................................................................... 8
Security Weaknesses ...................................................................................................................................................... 9
Vulnerabilities by Impact .............................................................................................................................................. 10
Web Application Penetration Test Findings................................................................................................................ 11
Stored Cross-Site Scripting (XSS) – FailSafe Application (High) .......................................................... 11
Insecure Direct Object Reference (IDOR) – FailSafe Application (High) ............................................. 14
Business Logic Flaw (BFLA) – Failsafe Application (High) .................................................................... 17
Broken Object Level Authorization (BOLA) – Failsafe Application (High) ............................................ 22
Additional Findings ........................................................................................................................................................ 24
Appendix A: Attempted But Unsuccessful Attacks .................................................................................................... 26
FailSafe
BUSINESS CONFIDENTIAL
Copyright © TCM Security (tcm-sec.com) Page 2 of 27
, Confidentiality Statement
This document is the exclusive property of FailSafe and TCM Security (TCMS). This document
contains proprietary and confidential information. Duplication, redistribution, or use, in whole or in
part, in any form, requires consent of both FailSafe and TCMS.
TCMS may share this document with auditors under non-disclosure agreements to demonstrate
penetration test requirement compliance.
Disclaimer
A penetration test is considered a snapshot in time. The findings and recommendations reflect the
information gathered during the assessment and not any changes or modifications made outside of
that period.
Time-limited engagements do not allow for a full evaluation of all security controls. TCMS prioritized
the assessment to identify the weakest security controls an attacker would exploit. TCMS
recommends conducting similar assessments on an annual basis by internal or third-party
assessors to ensure the continued success of the controls.
Contact Information
FailSafe
BUSINESS CONFIDENTIAL Page 3 of 27
