// SAMPLE REPORT · PENTEST
Pentest report for api.example.com.
The post-scan output from the new pentest reporting flow: verified domain context, coverage by engine, an executive summary, and normalized findings that teams can act on quickly.
Overall risk: Medium·Verified domain: example.com
Medium
1
findings
Low
1
findings
Info
1
observations
Engines
2
completed
Failed engines
0
no errors
Coverage
nucleicompleted
openapi-analysiscompleted
Executive summary
Medium
1
Low
1
Info
1
Failed engines
0
Findings
medium
Strict Transport Security header is missing
https://api.example.com
Evidence: Response did not include Strict-Transport-Security
Add Strict-Transport-Security after confirming the application is served exclusively over HTTPS.
info
OpenAPI document is publicly readable
https://api.example.com/openapi.json
Evidence: 200 OK without authentication
Confirm the document is intended to be public and excludes internal-only operations or sensitive examples.
low
Security headers missing on root application
https://api.example.com
Evidence: Missing Content-Security-Policy and X-Frame-Options
Add a baseline security header policy and validate it in staging before rollout.