TEASER L3 — Fennia · Sentinel Hub

Summary (teaser)

This is not “just a technical PDF”

A hacker uses these findings as a map. A hacker agent runs the same playbook in a 24/7 loop. Teaser = severity. FULL = proof + impact + fix.

recon → invasion → destructive · detail in FULL

Severe risks are on the public surface. This teaser shows counts and titles. The FULL report unlocks proof links, attacker/agent impact, owner, PoC, fix, and validation — so the team acts.

Stack in this run

Component	Included?	Note
Sentinel L3	YES	public-max
ParviClaw Core + AWP	YES (lab)	full pack in FULL
ParviSight	partial	as run
PayBotFin Witness	as engaged	honest scope in FULL

HIGH findings — locked in teaser

FE-H1

DMARC p=none

HIGH

████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████

🔒 Impact · link · PoC · owner · fix in FULL

FE-H2

CSP allows unsafe-inline + unsafe-eval and embeds non-prod hosts

HIGH

████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████

🔒 Impact · link · PoC · owner · fix in FULL

FE-H3

Public dev host with HTTP Basic (fefidev)

HIGH

████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████

🔒 Impact · link · PoC · owner · fix in FULL

MEDIUM findings — short preview

FE-M1

Public /preview returns HTTP 500

MEDIUM

Preview

Next.js __next_error__ shell on www for unauthenticated preview. Full impact, PoC, owner and fix → FULL report.

FE-M2

HSTS only 7 days; apex 301 without HSTS

MEDIUM

Preview

max-age=604800; includeSubDomains on www; apex awselb 301. Full impact, PoC, owner and fix → FULL report.

FE-M3

Brand-zone non-prod / analytics DNS public

MEDIUM

Preview

analytics.fefi*, analytics.fefitest*, fefi.aws mirrors live in public DNS. Full impact, PoC, owner and fix → FULL report.

FE-M4

Fat SPF multi-vendor

MEDIUM

Preview

Many includes (M365, Salesforce, Oracle, Telia, Webropol…) with hard-fail still OK. Full impact, PoC, owner and fix → FULL report.

FE-M5

PUT/DELETE/PATCH return 200 HTML

MEDIUM

Preview

Method matrix on www returns 200 HTML for several write methods (likely SPA shell). Full impact, PoC, owner and fix → FULL report.

AWP + Core annexes (preview)

In FULL each file has captions (what it is / what it proves / what it is not) + how to run npx agent-witness-protocol verify.