ShipmateSample
Penetration test letter
Shipmate ran a manual penetration test of Example Co's web app between 2 and 6 March 2026, with Example Co's written permission. This letter sums up what we tested and what happened to each finding.
- In scope
- app.example.com, its API and login
- Out of scope
- Marketing site, third-party services, physical and social testing
- Test dates
- 2–6 March 2026. Re-check on 12 March 2026
- Method
- Manual testing by a person across 8 areas, helped by tools. Every finding checked by hand.
Findings
| Severity | What we found | Status |
|---|---|---|
| High | One user could read another user's invoices | Fixed, re-checked |
| High | Payment webhook accepted unsigned requests | Fixed, re-checked |
| Medium | Password reset links did not expire | Fixed, re-checked |
| Low | Version number shown in a response header | Accepted by Example Co |
This letter is evidence that testing took place. It is not a certification, and no test finds everything. The full report is available to Example Co on request.
[Tester name]Shipmate