Three demonstration assessments, each run against a well-known intentionally-vulnerable application. They show the structure, evidence and retest discipline you receive on a real engagement — the format, not a client’s data.
All three targets are public training applications hosted locally for this demo. No third-party systems were tested and no real client data appears. On a real engagement, every finding is confirmed against your agreed scope only.
Modern SPA e-commerce. Auth bypass, access control, data exposure.
Classic PHP target. SQLi to DB dump, command injection, upload RCE.
Java lessons app. Insecure deserialization, access control, JWT, XXE.