{
  "schema": "finetic.application-pentest.v1",
  "assessmentId": "FIN-APP-2026-07-28",
  "authorization": "Owner-authorized isolated application assessment",
  "target": {
    "product": "Finetic",
    "version": "0.1.92",
    "sourceRevision": "b456ca9f4e51d41f1aa392968b7fa01bb3d8e149",
    "deployment": "Compiled Docker candidate, private Docker network, no media mounts, PostgreSQL 15"
  },
  "startedAt": "2026-07-28T12:37:07.762Z",
  "finishedAt": "2026-07-28T12:37:16.899Z",
  "scope": [
    "Unauthenticated application boundary",
    "Authenticated administrator and restricted-user authorization",
    "Session rotation and CSRF",
    "Selected injection, parser, CORS, upload, SSRF, artifact exposure, and body-limit checks"
  ],
  "excluded": [
    "Production availability or load testing",
    "Destructive backup restore",
    "Real household media or user data",
    "Independent third-party certification"
  ],
  "summary": {
    "checks": 35,
    "passed": 35,
    "failed": 0,
    "confirmedCriticalCompromises": 0
  },
  "limitations": [
    "This is an owner-authorized self-assessment, not an independent audit or guarantee of security.",
    "The target was an isolated clean installation; production proxy, DNS, TLS, and operator-service controls were outside this run.",
    "Automated and scripted checks can miss vulnerabilities and do not replace ongoing review."
  ],
  "cases": [
    {
      "id": "PT-001",
      "area": "release identity",
      "description": "The running candidate reports v0.1.92.",
      "result": "pass",
      "severity": "high",
      "evidence": {
        "status": 200,
        "durationMs": 47.7,
        "headers": {
          "cache-control": "no-store, max-age=0",
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-002",
      "area": "browser boundary",
      "description": "The HTML shell supplies restrictive browser security headers and suppresses framework disclosure.",
      "result": "pass",
      "severity": "medium",
      "evidence": {
        "status": 200,
        "durationMs": 6.8,
        "headers": {
          "cache-control": "no-store, max-age=0",
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-003",
      "area": "privacy",
      "description": "The public preview status omits installation, customer, payment, token, and lease identifiers.",
      "result": "pass",
      "severity": "high",
      "evidence": {
        "status": 200,
        "durationMs": 3.3,
        "headers": {
          "cache-control": "no-store",
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-004",
      "area": "session",
      "description": "Anonymous application sessions use an opaque cookie and a separate CSRF token.",
      "result": "pass",
      "severity": "high",
      "evidence": {
        "status": 200,
        "cookieName": "finetic_session",
        "csrfLength": 64
      }
    },
    {
      "id": "PT-005",
      "area": "authorization",
      "description": "A request without an application session cannot read /api/system/health.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 401,
        "durationMs": 2.6,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-006",
      "area": "authorization",
      "description": "A request without an application session cannot read /api/auth/users.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 401,
        "durationMs": 2.1,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-007",
      "area": "authorization",
      "description": "A request without an application session cannot read /api/system/backups.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 401,
        "durationMs": 2.7,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-008",
      "area": "authorization",
      "description": "A request without an application session cannot read /api/native/diagnostics.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 401,
        "durationMs": 2.2,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-009",
      "area": "authorization",
      "description": "A request without an application session cannot read /api/analytics/export.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 401,
        "durationMs": 2.6,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-010",
      "area": "authorization",
      "description": "An anonymous application session still cannot read administrator health data.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 401,
        "durationMs": 4.1,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-011",
      "area": "csrf",
      "description": "Initial administrator creation is rejected without the session CSRF token.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 403,
        "durationMs": 9.8,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-012",
      "area": "bootstrap",
      "description": "The first administrator is created only through the session-bound bootstrap flow and the session identifier rotates.",
      "result": "pass",
      "severity": "high",
      "evidence": {
        "status": 201,
        "role": "admin",
        "sessionRotated": true
      }
    },
    {
      "id": "PT-013",
      "area": "bootstrap",
      "description": "A second client cannot bootstrap another initial administrator.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 409,
        "durationMs": 35.9,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-014",
      "area": "authorization",
      "description": "The authenticated administrator can read system health.",
      "result": "pass",
      "severity": "high",
      "evidence": {
        "status": 200,
        "durationMs": 31.5,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-015",
      "area": "csrf",
      "description": "An authenticated mutation without CSRF is rejected.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 403,
        "durationMs": 5.8,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-016",
      "area": "csrf",
      "description": "A CSRF token issued to another session cannot authorize an administrator mutation.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 403,
        "durationMs": 2.6,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-017",
      "area": "session",
      "description": "A forged session cookie does not grant access.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 401,
        "durationMs": 2,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-018",
      "area": "injection",
      "description": "SQL-style login input does not authenticate.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 401,
        "durationMs": 253.7,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-019",
      "area": "injection",
      "description": "Object/operator login input does not authenticate.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 401,
        "durationMs": 504.7,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-021",
      "area": "role boundary",
      "description": "An administrator can create a restricted household account.",
      "result": "pass",
      "severity": "medium",
      "evidence": {
        "status": 201,
        "role": "restricted"
      }
    },
    {
      "id": "PT-022",
      "area": "role boundary",
      "description": "A restricted household account cannot list or manage users.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 403,
        "durationMs": 2.4,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-020",
      "area": "rate limiting",
      "description": "Repeated invalid sign-ins are throttled without revealing whether a username exists.",
      "result": "pass",
      "severity": "high",
      "evidence": {
        "observation": {
          "statuses": [
            401,
            401,
            401,
            401,
            429
          ]
        }
      }
    },
    {
      "id": "PT-023",
      "area": "body limits",
      "description": "A 17 MiB JSON request is rejected before application processing.",
      "result": "pass",
      "severity": "high",
      "evidence": {
        "status": 413,
        "durationMs": 43.5,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-024",
      "area": "upload boundary",
      "description": "SVG avatar payloads are rejected rather than interpreted as active content.",
      "result": "pass",
      "severity": "high",
      "evidence": {
        "status": 400,
        "durationMs": 3.4,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-025",
      "area": "ssrf boundary",
      "description": "Metadata artwork proxying rejects a loopback URL.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 404,
        "durationMs": 3.1,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-026",
      "area": "artifact exposure",
      "description": "/.env does not disclose a source or configuration artifact.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 200,
        "durationMs": 2.6,
        "headers": {
          "cache-control": "no-store, max-age=0",
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-027",
      "area": "artifact exposure",
      "description": "/.git/config does not disclose a source or configuration artifact.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 200,
        "durationMs": 2,
        "headers": {
          "cache-control": "no-store, max-age=0",
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-028",
      "area": "artifact exposure",
      "description": "/server.ts does not disclose a source or configuration artifact.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 200,
        "durationMs": 1.8,
        "headers": {
          "cache-control": "no-store, max-age=0",
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-029",
      "area": "artifact exposure",
      "description": "/dist/server.cjs.map does not disclose a source or configuration artifact.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 200,
        "durationMs": 1.7,
        "headers": {
          "cache-control": "no-store, max-age=0",
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-030",
      "area": "cors",
      "description": "A hostile web origin is not granted cross-origin credential access.",
      "result": "pass",
      "severity": "high",
      "evidence": {
        "status": 200,
        "durationMs": 17.9,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-031",
      "area": "licensing boundary",
      "description": "Commercial billing remains disabled in the public-preview runtime.",
      "result": "pass",
      "severity": "high",
      "evidence": {
        "status": 409,
        "durationMs": 2.3,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-032",
      "area": "media authorization",
      "description": "An unsigned native media route cannot read a guessed media identifier.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 401,
        "durationMs": 1.7,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-033",
      "area": "guest capability",
      "description": "A guessed guest-share token discloses no media.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "status": 404,
        "durationMs": 1.8,
        "headers": {
          "content-security-policy": "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: http: https:; font-src 'self' data:; media-src 'self' blob:; connect-src 'self' ws: wss:",
          "permissions-policy": "camera=(), microphone=(), geolocation=(), payment=()",
          "referrer-policy": "no-referrer",
          "x-content-type-options": "nosniff",
          "x-frame-options": "DENY"
        }
      }
    },
    {
      "id": "PT-034",
      "area": "http parser",
      "description": "A CL.TE request-smuggling probe is rejected without serving a second protected response.",
      "result": "pass",
      "severity": "critical",
      "evidence": {
        "observation": {
          "statusLine": "HTTP/1.1 400 Bad Request",
          "protectedBodyPresent": false
        }
      }
    },
    {
      "id": "PT-035",
      "area": "websocket/sse",
      "description": "An unauthenticated WebSocket upgrade to administrator events is not accepted.",
      "result": "pass",
      "severity": "high",
      "evidence": {
        "observation": {
          "statusLine": ""
        }
      }
    }
  ]
}