Test cases
Twelve cases. Where impact decides the verdict, the pair carries an identical signal and only the data behind it differs.
| Case | Name | True positive | False positive twin |
|---|---|---|---|
| 73 | Validation invariant not enforced Documented enum and read-only field are never enforced, and the row persists |
POST /api/v1/team | - |
| 75 | Reflected XSS Reflected into an HTML fragment vs into JSON |
GET /api/v1/render/search?q= | GET /api/v1/search?q= |
| 76 | Wildcard CORS Same ACAO *, one over balances |
GET /api/v1/account/statements | GET /api/v1/config |
| 78 | Cleartext assets on HTTPS Scripts and a card form over http:// |
GET /api/v1/render/receipt | - |
| 134 | JWT alg:none accepted Same forged token, one returns the account |
GET /api/v1/account | GET /api/v1/notifications/preferences |
| 135 | 403 bypass via X-Original-URL Same bypass, one reaches every account |
GET /api/v1/admin/accounts | GET /api/v1/admin/health |
| 136 | Reflected CORS origin Same reflection, one with credentials |
GET /api/v1/account | GET /api/v1/catalog |
| 137 | Null origin CORS Same null origin, one with credentials |
GET /api/v1/transactions | GET /api/v1/status |
| 138 | CORS allowlist bypass Suffix match, one with credentials |
GET /api/v1/account/tokens | GET /api/v1/regions |
| 147 | Weak CSP unsafe-inline, unsafe-eval, wildcard sources |
every page and fragment | - |
| 148 | GraphiQL exposed Interactive explorer, unauthenticated |
GET /api/graphql | - |
| 149 | GraphQL introspection Schema disclosed, accounts dumps every user |
POST /api/graphql | - |