Eonycs assessment report — fictional demonstration data
demo-app.example.com · 18 Aug 2026, 09:04 → 18 Aug 2026, 09:31 · 27m 36s
Recorded scope: /, /search, /account/*, /api/v1/* — excluded: /static/*, /healthz
Budget limits: 120 verifications · 3.0M tokens · 45 min
Coverage summary
| Endpoints discovered | Tested | Not tested | Inconclusive | Tool errors | Candidate findings |
| 52 | 47 | 5 | 2 | 1 | 61 |
|---|
Findings
EON-0042 — Reflected XSS via search parameter
Severity: HIGH · Verdict: TRUE — confirmed · GET /search · param: q · CVSS 6.1
Responsible location: app/views.py:42
Reproduction summary: A mechanical canary token sent in the q parameter is reflected into the HTML response without escaping and executes in a real browser context.
Remediation guidance: Render the query with the framework's escaped output helper instead of string interpolation, and add a Content-Security-Policy as defense in depth.
EON-0037 — SQL injection in account export
Severity: CRITICAL · Verdict: TRUE — confirmed · GET /account/export · param: format · CVSS 8.6
Responsible location: app/exports.py:18
Reproduction summary: A single quote in the format parameter produces a 500 response; closing the quote returns 200. The value reaches the query syntax — it breaks when unbalanced and stops breaking when balanced.
Remediation guidance: Build the export query with bound parameters via the ORM instead of f-string interpolation of the format value.
EON-0031 — Open redirect on login return URL
Severity: MEDIUM · Verdict: TRUE — confirmed · GET /login · param: next · CVSS 4.7
Responsible location: app/auth.py:64
Reproduction summary: The next parameter is copied into the Location header after login. Cross-host redirects were not followed, per scope rules; the canary host appears verbatim in the header.
Remediation guidance: Validate next against an allow-list of relative paths before issuing the redirect.
EON-0028 — Local file inclusion in template loader
Severity: HIGH · Verdict: TRUE — confirmed · GET /api/v1/render · param: template · CVSS 7.5
Responsible location: app/api/render.py:11
Reproduction summary: A path canary in the template parameter causes the loader to resolve a file outside the template root, confirmed by a marker file planted inside the fictional demo app.
Remediation guidance: Resolve template names against a fixed allow-list; never pass user input to the filesystem loader.
EON-0024 — Missing security headers on authenticated routes
Severity: LOW · Verdict: TRUE — confirmed · GET /account · CVSS 3.1
Reproduction summary: Responses on /account lack X-Content-Type-Options, Referrer-Policy, and a frame-ancestors directive.
Remediation guidance: Enable the framework's security middleware and set a restrictive Content-Security-Policy.
EON-0019 — Verbose error page leaks framework version
Severity: INFO · Verdict: TRUE — confirmed · GET /api/v1/orders
Reproduction summary: A malformed request returns a debug stack trace including the framework version and absolute paths.
Remediation guidance: Disable debug mode in production and route errors to a generic error page.
EON-0015 — Command execution in report generator
Severity: CRITICAL · Verdict: NaD — undetermined · POST /api/v1/reports · param: name
Responsible location: app/reports.py:55
Reproduction summary: A timing probe produced ambiguous latency that could not be separated from background noise within the verification budget. Not confirmed; not ruled out.
Remediation guidance: Review the report name handling in app/reports.py regardless; avoid passing user input to shell invocations.
EON-0011 — Stored XSS candidate in comment field
Severity: MEDIUM · Verdict: FALSE — ruled out · POST /comments · param: body
Responsible location: app/comments.py:27
Reproduction summary: Canary submitted, stored, and re-rendered: the value is HTML-escaped on output in all observed contexts. Ruled out by evidence.
Remediation guidance: No action required. Keep the output encoding covered by a regression test.
EON-0007 — SSRF probe on webhook tester
Severity: HIGH · Verdict: ERROR — tool failure · POST /api/v1/webhooks/test · param: url
Reproduction summary: The browser verification harness crashed during this probe. ERROR is a tool failure, not a security verdict — this item is untested, not safe.
Remediation guidance: Re-run with an increased verification budget once the harness issue is resolved.
EON-0003 — Session cookie without SameSite attribute
Severity: LOW · Verdict: TRUE — confirmed · GET /login · CVSS 3.7
Reproduction summary: The session cookie is set without SameSite; Secure and HttpOnly are present.
Remediation guidance: Set SameSite=Lax (or Strict) on the session cookie.