WHAT YOU TAKE AWAY

Work your team can act on.

For software and SaaS teams, this supports remediation, customer security reviews and release decisions. We also qualify other organizations around their assets and objectives.

For leadership and procurement: Documented scope, a summary of impact and priorities, and the assessment’s limitations.
For engineers: Validated findings with evidence, reproduction steps and remediation guidance.
For closing findings: One validation pass for original findings, requested within 90 days of report delivery.

INSIDE THE REPORT

From engagement context to an actionable finding.

REPORT SPECIMEN · SYNTHETIC EXAMPLE

Context first. Then the evidence.

Scope: A fictional billing application in staging. Two synthetic accounts and the invoice access workflow.
Method: Compare account permissions, reproduce unauthorized access, then verify the remediation.
Executive summary: Missing invoice ownership checks allow one account to read another account’s invoice. Prioritize a server-side ownership check.
Limitations: One workflow showing the reporting format; not a complete application assessment, certification or real client result.

An engagement report records testing dates and scope, the testers and approving reviewer, coverage and limitations.

ZERODAY / SECURITY REPORTILLUSTRATIVE SAMPLE

A hand draws a duplicate invoice from beneath a carbon sheet while the original stays attached to its pad.

A copy reaches the wrong account.

FINDING R–01High severity

Cross-account access to invoices

Attack path: The invoice endpoint (GET /api/v2/invoices/{id}) trusted a sequential id from the URL and never checked that the invoice belonged to the calling account. A standard user decrementing the id read invoices from other tenants.
Evidence: Two accounts provisioned under the ROE. Account A requested id 41022; substituting an id owned by Account B returned B’s invoice — full billing name, address, and line items — with A’s session token. Captured request/response saved and hashed.
Impact: Any authenticated tenant could enumerate and read every other tenant’s billing records. Cross-tenant exposure of personal and commercial data; no privilege escalation required.
Remediation: Enforce an ownership check server-side (the invoice’s account must equal the caller’s) before returning the record; move to non-sequential identifiers as defense in depth. Verified by the Zeroday operator, not the engine.
RETEST: Ownership check added; re-tested with the same two accounts — cross-tenant read no longer possible. Closed.

Fictional example. No client data or real engagement results.

HUMAN EXPERTISE + OBSIDIAN

Machine exploration. Human accountability.

Obsidian is Zeroday’s internal technology for exploration and testing within authorized boundaries. Experts validate the findings and evidence and approve the final report.

Zeroday’s team remains accountable for scope and delivery. Obsidian is part of the service and is not separately licensed.

How Obsidian works

An ink illustration of an upright black obsidian rock, with irregular facets and violet accents.

HOW THE ENGAGEMENT WORKS

A clear process, from scope to validation.

A measuring tape defines the dimensions of one laptop, while a phone and notebook remain outside its boundary.

01

Define the scope

Agree assets, objectives, boundaries, fees and timing.

A hand offers a small contact card while a thick plum document folio remains closed under its retaining band.

02

Establish authorization

Validate authority and confirm rules of engagement and contacts before testing.

A magnifying glass enlarges a torn paper fiber on a proof sheet, with a red pencil marking the precise defect.

03

Test and review

AI-led exploration, with expert validation and final-report approval.

Both ends of a repaired network cable connect to a cable tester, with a row of indicators checking continuity.

04

Validate the fixes

Request one validation pass for the original findings within 90 days of report delivery.

Standard engagements are paid assessments regardless of finding count. Scope, fees and payment timing are agreed before testing. One validation pass for original findings is included when requested within 90 days of report delivery.

Before you begin.

What can you test?: We discuss web and mobile applications and infrastructure, then document the targets and boundaries. No environment is automatically included.
Do we pay if no vulnerabilities are found?: Yes. You pay for the agreed assessment regardless of finding count. The report records what was tested and the limits of coverage.
How long does it take, and what does it cost?: Price it with the calculator above: tests start at $1,500 for one application, and bigger scopes add published amounts. Fees, dates and payment terms are confirmed in the accepted order after scope review.
Can we share the report with customers?: We agree permitted recipients and usage during contracting, including when the report supports customer or procurement reviews.
What does validation include?: One pass for the original findings, requested within 90 days of report delivery. New assets or material changes require a separate scope.

START A CONVERSATION

Let’s define the right scope.

Share your objective, timing and a broad outline of your environment. We agree scope, fees and terms before any work begins.

An enquiry does not authorize security testing.

Not ready to scope a test? Take the free self-check

Loading enquiry form…

Evidence for your team. Clarity for your customers.