Things worth downloading

Broken access control is consistently among the most common serious flaw classes in web applications, and it is the one most testing misses, because finding it requires holding two identities at once and comparing what each can reach.

This checklist covers the role combinations worth testing, the cross-access attempts to make against each resource type, what a failure actually looks like in a response, and the cases most teams skip. Usable with any tooling.

Spec-driven coverage, object-level authorisation, GraphQL introspection concerns, gRPC, token scope verification, response content inspection.

Scope definition, cadence by asset criticality, roles and responsibilities, severity handling, acceptance workflow, evidence retention.

A complete assessment report, fully redacted. Executive summary with risk scoring and trend comparison, detailed findings with request and response evidence, remediation guidance with vulnerable and secure code examples, and control mapping.

If you are evaluating what an assessment actually produces, this is the most direct answer available.