Proven findings
5
1 critical · 2 high · 1 medium · 1 low
Candidates evaluated
23
18 held below the reporting line
Last run duration
84m 12s
completed · all probes in scope
Reporting line
Tier 3+
gate-verified or better, always
Selected run breakdown
CRITICAL 1
HIGH 2
MEDIUM 1
LOW 1
Target: meridian-demo.example · authorized allowlist per signed ROE
Started Jun 11, 2026 · 12:30 AM · Completed 02:01 AM
Started Jun 11, 2026 · 12:30 AM · Completed 02:01 AM
Recent scans
meridian-demo.example
5 proven · 23 candidates
claims.meridian-demo.example
2 proven · 11 candidates
api.meridian-demo.example
3 proven · 14 candidates
Scan in progress — meridian-demo.example0%
Live verification feed
Scope ledger · every decision logged
api.meridian-demo.example/v2/*
rule: allowlist · signed ROE
ALLOWED
mdm-staging.example-cdn.net
rule: not in authorization
DENIED
Fail-closed at three layers. Scope can be tightened mid-run — never widened. Denied requests never leave the platform.
| Severity | Finding | Asset | Tier |
|---|---|---|---|
| CRITICAL | IDOR — policy documents readable by changing the ID GT-2041 · GET /v2/policies/{id}/documents · 4/4 gates |
api.meridian-demo.example | TIER 4 · proven |
| HIGH | Admin panel exposed to the public internet GT-2044 · /admin reachable without any session · 4/4 gates |
claims.meridian-demo.example | TIER 4 · proven |
| HIGH | SQL injection in search parameter GT-2047 · GET /v2/search?q= · 4/4 gates · authenticity pending |
api.meridian-demo.example | TIER 3 · caveat shown |
| MEDIUM | Verbose error response discloses internal hostnames GT-2052 · 500 handler leaks infrastructure detail · 4/4 gates |
claims.meridian-demo.example | TIER 4 · proven |
| LOW | Forgotten staging environment serving production data GT-2060 · staging.meridian-demo.example · 4/4 gates |
staging.meridian-demo.example | TIER 4 · proven |
GT-2041 · IDOR — policy documents readable by changing the ID
Evidence bundle · self-contained
→request.rawexactly what was sent
←response.rawexactly what came back
✓gate_decisions.jsonG1–G4, each with rationale
⛨authenticity.jsonreal target, real network path
⟳replay.mdverify it yourself, no GhostTrace needed
✓Gates: G1 reachable · G2 signal · G3 exploitable · G4 impact — all passed, plus the authenticity check. This finding earned Tier 4.
Replay · verify it on your side
# request a policy object you do not own
curl -s "$API/v2/policies/88412/documents"
# response
HTTP/2 200 ← expected 403/404
{"policy_id": 88412, "documents": [ ... ]}
✓ object returned without authorization · captured in response.raw
curl -s "$API/v2/policies/88412/documents"
# response
HTTP/2 200 ← expected 403/404
{"policy_id": 88412, "documents": [ ... ]}
✓ object returned without authorization · captured in response.raw
Candidates evaluated
23
Proven · reported
5
Held below Tier 3
14
Chain-noise dropped
4
✓PROVEN_RECONCILE before=9 after=5 dropped=4
✓self-asserted chain candidates rejected by the gates
✓duplicates targeting the same weakness merged
≡ the count is always reported — reconciliation can't silently drop what you saw
Run artifacts · the audit trail
results.json — every candidate, gates, tier, disposition
activation_ledger.jsonl — every capability that fired
scope_ledger.jsonl — every allow/deny decision
evidence/ — a self-contained bundle per proven finding
activation_ledger.jsonl — every capability that fired
scope_ledger.jsonl — every allow/deny decision
evidence/ — a self-contained bundle per proven finding
That's the discipline.
Authorized, previewed, gated, reconciled — every finding backed by evidence you can verify yourself. See it run against your own surface.