Web application and API report: available on request
The web application and its API backend, tested as two scopes and reported together because they share authentication, session handling and one authorisation model.
This is one of three reports from a single engagement (2026-09-ACM), written to the format we submit for Amazon Selling Partner API Data Protection Policy reviews. It carries 12 findings, each with a CVSS score, reproduction steps, evidence and a remediation deadline derived from DPP clause 2.7.3.
What this report evidences
- ›Authentication, session handling and the shared authorisation model across both scopes
- ›Login with Amazon (LWA) and OAuth token handling: issuance, refresh, storage and rotation
- ›Business logic and access control between tenants
- ›Input handling, injection classes and cryptographic storage
Scope category under the Data Protection Policy: 2.7.2 application layer assets (web apps, APIs). The DPP requires a penetration test at least every 365 days using an industry recognised methodology; it does not require the tester to hold any particular empanelment or certification.
Ask and a founder will send it
We send the full set: web and API, external network, and cloud, as three PDFs. Requests are read by Ashok or Rathnakara before anything is sent, which is why this is not an instant download. Tell us what you are building against SP-API and which restricted role you hold, and the reply will be useful rather than automated.
Request the SP-API report setWant to see how we write a report before asking? The full generic sample report is published in its entirety, no request needed, and uses the same structure, severity model and evidence standard.