Eficode L3 — teaser preview
7 HIGH · 6 MEDIUM. Severe risks are on the public surface. This teaser shows counts and titles. The FULL report unlocks proof links, attacker/agent impact, owner, PoC, fix, and va
Summary (teaser)
This is not “just a technical PDF”
A hacker uses these findings as a map. A hacker agent runs the same playbook in a 24/7 loop. Teaser = severity. FULL = proof + impact + fix.
recon → invasion → destructive · detail in FULLSevere risks are on the public surface. This teaser shows counts and titles. The FULL report unlocks proof links, attacker/agent impact, owner, PoC, fix, and validation — so the team acts.
Stack in this run
| Component | Included? | Note |
|---|---|---|
| Sentinel L3 | YES | public-max |
| ParviClaw Core + AWP | YES (lab) | full pack in FULL |
| ParviSight | partial | as run |
| PayBotFin Witness | as engaged | honest scope in FULL |
HIGH findings — locked in teaser
Public SonarQube with unauthenticated system status/version
HIGHPublic Bitwarden vault on brand DNS
HIGHPublic Helix TeamHub (source/collab)
HIGHJenkins internet-facing
HIGHJira auth edge public
HIGHGlobaLeaks whistleblow public
HIGHBroken public media hosts (502)
HIGHMEDIUM findings — short preview
CSP only frame-ancestors on www
MEDIUMResponse headers Full impact, PoC, owner and fix → FULL report.
No security.txt
MEDIUM404 on `/.well-known/security.txt` Full impact, PoC, owner and fix → FULL report.
DMARC `p=quarantine` not reject
MEDIUM`_dmarc` TXT Full impact, PoC, owner and fix → FULL report.
Brand DNS maps corp stack
MEDIUMintra→Atlassian hub; jira→atlassian; it→servicedesk; netsuite→login Full impact, PoC, owner and fix → FULL report.
eficloud public Nextcloud login
MEDIUM302 → `/login`; Apache + NC cookies Full impact, PoC, owner and fix → FULL report.
Shared engineering IP for Sonar/TeamHub/Jenkins
MEDIUMSame A `136.243.128.188` Full impact, PoC, owner and fix → FULL report.
AWP + Core annexes (preview)
In FULL each file has captions (what it is / what it proves / what it is not) + how to run npx agent-witness-protocol verify.