# Sprint 35 Phase 5 — Penetration test report

- target: `https://lydos.ailydian.com`
- generated: 2026-05-13T21:30:02.502717Z
- total tests: 24
- passed: 24
- failed: 0

## INFO (24)

- **OWASP-A01-/api/admin/users** — ✓ pass — A01 access control: anonymous GET to admin endpoint
  - expected 401/403/404, got 401
- **OWASP-A01-/api/admin/agents** — ✓ pass — A01 access control: anonymous GET to admin endpoint
  - expected 401/403/404, got 401
- **OWASP-A01-/api/admin/kill-switch/status** — ✓ pass — A01 access control: anonymous GET to kill-switch admin
  - expected 401/403/404, got 401
- **OWASP-A01-/api/internal/debug** — ✓ pass — A01 access control: anonymous GET to internal debug
  - expected 401/403/404, got 401
- **OWASP-A01-path-traversal** — ✓ pass — A01 path traversal probe
  - status 403; body must not include root: line
- **OWASP-A02-HSTS** — ✓ pass — A02 HSTS header present
  - strict-transport-security: max-age=31536000; includeSubDomains; preload
- **OWASP-A02-CSP** — ✓ pass — A02 Content-Security-Policy present
  - CSP length 22
- **OWASP-A03-SQLi-error-leak** — ✓ pass — A03 SQL injection probe must not surface SQL errors
  - signatures matched: []
- **OWASP-A03-XSS-reflection** — ✓ pass — A03 XSS payload must not reflect un-escaped
  - reflected: False
- **OWASP-A05-no-x-powered-by** — ✓ pass — A05 no X-Powered-By header (no tech stack disclosure)
  - X-Powered-By: absent
- **OWASP-A05-server-version** — ✓ pass — A05 server header does not leak version
  - server: cloudflare
- **OWASP-A05-frame-protection** — ✓ pass — A05 clickjacking protection in place
  - frame-ancestors/X-Frame-Options ok=True
- **OWASP-A07-magic-fake-token** — ✓ pass — A07 magic-link fake token must reject
  - fake token verify status 400
- **OWASP-A09-asr-chain-gate** — ✓ pass — A09 ASR chain verify endpoint behind auth
  - status 401
- **OWASP-A10-ssrf-loopback** — ✓ pass — A10 SSRF probe (loopback)
  - status 403, suspicious body=False
- **OWASP-A10-ssrf-aws-metadata** — ✓ pass — A10 SSRF probe (aws-metadata)
  - status 403, suspicious body=False
- **OWASP-A10-ssrf-file-scheme** — ✓ pass — A10 SSRF probe (file-scheme)
  - status 403, suspicious body=False
- **KURAL-18-ksl-mutation-no-sig** — ✓ pass — KURAL 18: KSL mutation without signature must reject
  - status 401 (expected 401/403)
- **KURAL-18-ksl-forged-sig** — ✓ pass — KURAL 18: forged KSL signature must reject
  - status 401 (expected 401/403)
- **KURAL-19-chain-delete** — ✓ pass — KURAL 19: DELETE on audit chain must reject
  - status 401
- **KURAL-19-chain-put** — ✓ pass — KURAL 19: PUT on audit chain must reject
  - status 401
- **KURAL-19-chain-patch** — ✓ pass — KURAL 19: PATCH on audit chain must reject
  - status 401
- **KURAL-22-lsia-mode-observable** — ✓ pass — KURAL 22: LSIA mode endpoint returns a valid mode
  - body excerpt: {"mode":"OPERATIONAL","transitioned_at":"2026-05-10T09:02:30.651945+00:00","reason":null}
- **KURAL-23-federation-gated** — ✓ pass — KURAL 23: federation sample endpoint properly auth-gated
  - status 401 — endpoint not anonymously readable