retest.asiaEarly accessGet your report card

The deliverable

This is what you get.

One report card, four subjects, security first. Every subject graded, every finding explained, every fix planned. One signature.

Get your report cardHow it works

Illustrative sampleThe product, marks and findings on this page are invented to show the format.

Front — the marks

The sample report, in full

The card, line by line.

Below is the whole document, in the order your team reads it: every mark, finding and fix. A pentest PDF describes the hole. This card plans the fix.

Report cardIllustrative sampleSigned by a senior reviewer

acme-shop.comillustrative

Scope
Web app and public API on staging; read-only on production for headers and TLS. Agreed in writing, consent signed, before anyone touched anything.
Limitations
Not tested: the payment provider's hosted page and the native apps. Nothing outside the written scope.
Tested by
People, real devices and controlled agents — under human review
How it ran
  • ScopeAgreed in writing · consent signed
  • TestAgreed scope only · people, devices, agents
  • Report cardWithin 72 hours of the test · signed
  • RetestSame agreed scope, once the fix plan ships

Marks

  • SecurityOWASP · auth abuse · data exposureA
  • UI & UXvisual defects · journeysB+
  • Usability & Performancetask completion · web vitalsB-
  • Conversionfunnel leaks · trust signalsA
PASSwhole card92/100

Security: three findings open, none Critical or High, each with a fix plan attached.

PASS and the overall score grade the whole product, not the security row. Neither is a safety claim.

Findings

Open a finding to read it in full — the first one is open. Grouped by subject, security first.

SecurityA
Session cookie travels unprotected on one subdomainauth.acme-shop.com · Set-Cookie on /loginFound by agent · confirmed by handMedium
Where it sits
auth.acme-shop.com · Set-Cookie on /login
Severity
Medium
Evidence
The status subdomain accepts the session cookie over plain http, so the token travels in the clear there. The Secure flag is not set.
Impact
On an open network, anyone on the path can read the token and open the account it belongs to.
Priority
Now
Fix plan
Set Secure and SameSite=Lax on the session cookie. Redirect plain http to https everywhere.
Status
Open — fix plan attached
Password reset has no rate limitPOST /api/auth/resetFound by agent · confirmed by handMedium
Where it sits
POST /api/auth/reset
Severity
Medium
Evidence
A burst of reset requests from one address was answered in full — no slow-down, no lock-out, no alert.
Impact
Lets an attacker flood a customer's inbox and probe which emails hold an account.
Priority
Next
Fix plan
Return the same answer whether or not the email exists. Rate-limit by address and by account.
Status
Open — fix plan attached
Checkout bundle ships a library with a public advisorycheckout.js · one dependencyFound by agent · confirmed by handLow
Where it sits
checkout.js · one dependency
Severity
Low
Evidence
The vulnerable code path is not reachable from the checkout page today. The advisory is public.
Impact
None today; one refactor away from a real problem.
Priority
Later
Fix plan
Bump the dependency, then add an advisory check to CI so the next one fails the build.
Status
Open — fix plan attached
UI & UXB+
Error text hides under the keyboard on phonesSign-up form · phone viewportFound by human testerMedium
Where it sits
Sign-up form · phone viewport
Severity
Medium
Evidence
On a mid-range Android the validation message renders below the fold while the keyboard is open. Testers pressed submit twice before they saw it.
Impact
Confusion at the first step of the journey, on the phone your customer is holding.
Priority
Next
Fix plan
Put the error beside its field and scroll it into view on submit.
Status
Open — fix plan attached
Two different “Add to cart” buttons on one pageProduct page · main button and sticky barFound by human testerLow
Where it sits
Product page · main button and sticky bar
Severity
Low
Evidence
The main button and the sticky bar differ in label and colour. Testers asked which one to press.
Impact
A pause at the moment of intent.
Priority
Later
Fix plan
The sticky bar mirrors the main button: one label, one style, one colour.
Status
Open — fix plan attached
Usability & PerformanceB-
Product page paints late over mobile data/products/* · mid-range Android · mobile networkFound by device panel · confirmed by handHigh
Where it sits
/products/* · mid-range Android · mobile network
Severity
High
Evidence
On a real network the hero image lands after the tester has already scrolled past it. The text shifts when it arrives.
Impact
The first thing a customer sees is the page moving under their thumb.
Priority
Now
Fix plan
Size and preload the hero image, ship it at the viewport's width, and reserve its space so nothing shifts.
Status
Open — fix plan attached
Checkout asks for the address twiceCheckout · payment stepFound by human testerMedium
Where it sits
Checkout · payment step
Severity
Medium
Evidence
“Same as shipping” is unticked by default. Every tester typed the address again.
Impact
Extra typing on a phone, at the step where people give up.
Priority
Next
Fix plan
Tick “same as shipping” by default; one checkbox to change it.
Status
Open — fix plan attached
Search finds the plural but not the singularSite searchFound by agent · confirmed by handMedium
Where it sits
Site search
Severity
Medium
Evidence
“shoes” returns the catalogue; “shoe” returns an empty page with no suggestion.
Impact
A customer who typed what they wanted sees nothing for sale.
Priority
Next
Fix plan
Stem the query and show “did you mean” on an empty result.
Status
Open — fix plan attached
ConversionA
Shipping cost appears only at the last stepCheckout · order summaryFound by human testerMedium
Where it sits
Checkout · order summary
Severity
Medium
Evidence
Testers paused at the total; some went back to the cart to check. The shipping line is the first surprise in the journey.
Impact
A surprise at the total is the classic reason people abandon a cart.
Priority
Next
Fix plan
Show estimated shipping on the cart page and again before payment.
Status
Open — fix plan attached
Guest checkout hides behind “Create account”Checkout · first stepFound by human testerLow
Where it sits
Checkout · first step
Severity
Low
Evidence
The guest option sits in small text under the sign-up form. Testers started creating an account they did not want.
Impact
Friction for the buyer who just wants to pay.
Priority
Later
Fix plan
Put “Continue as guest” beside the account button, same size.
Status
Open — fix plan attached

Fix plan

A cheap fix to a medium finding can sit above an expensive fix to a high one. Priority is the order to fix, not the severity.

PriorityFindingOwnerEffortRetest
NowSession cookie travels unprotectedBackendSmallBy agent, confirmed by hand
NowProduct page paints late on mobile dataFrontendMediumOn the device panel
NextPassword reset has no rate limitBackendSmallBy agent, confirmed by hand
NextError text hides under the keyboardFrontendSmallBy human tester
NextCheckout asks for the address twiceFrontendSmallBy human tester
NextSearch misses the singularBackendMediumBy agent, confirmed by hand
NextShipping cost only at the last stepProduct + FrontendMediumBy human tester
LaterLibrary with a public advisory in checkoutPlatformSmallBy agent
LaterTwo “Add to cart” buttonsDesign + FrontendSmallBy human tester
LaterGuest checkout hiddenFrontendSmallBy human tester

Retest

Same scope, same four subjects, once the fix plan ships. The next card marks what moved.

Signature

Signed by a senior reviewer

A person's name is on the call that each finding is real — not a tool's confidence score.

Across releases

Read it against the last one.

A retest checks the agreed findings after the fixes ship, on a schedule you set. Same four subjects, same order, so one card reads against the last. A scan forgets the last run. A retest remembers it.

Illustrative — last term → this termSame four subjects, same order
  1. SecurityBA

    Public invoice bucket closed and retested. Two mediums remain, both planned.

  2. UI & UXBB+

    Checkout fits a phone screen without sideways scrolling. Error text still hides on phones.

  3. Usability & PerformanceC+B-

    Search no longer times out on the catalogue. The product page still paints late.

  4. ConversionA-A

    Trust marks now sit above the pay button. Shipping still arrives as a surprise.

Book a test

Tell us what needs testing.

A URL and two sentences is enough. The scope comes back in writing; nothing starts until you sign it.

Book a test

Report card in 72 hoursNDA + written consentSigned by a senior reviewer