Agentic Testari Sentinel Hub · FriendlyAI agentictestari.com

Luottamuksellinen

L3 MAX Public-max · ei-tuhoava

Julkisen pinnan arviointi — NoA Ignite

Apex marketing cleaner than product hosts. True L3: Swagger on BFM prod, unauthenticated metrics API, SPA token/source-map class plus related brand tools. HIGH 5 · MEDIUM 4.

Kohde noaignite.com Päivä 2026-07-29 RoE public-max · ei-tuhoava Engagement eng_noaignite_l3_1358

HIGH

MED

INFO

—

Johtoyhteenveto

Miksi toimia nyt

Nämä havainnot eivät ole teoreettisia: ne ovat julkisia pintoja. Jokaisessa kortissa on todiste, vaikutus, omistaja, korjaus ja validointi.

Jokainen havainto: ongelma, missä, vaikutus, omistaja, PoC, korjaus, validointi.

Apex marketing cleaner than product hosts. True L3: Swagger on BFM prod, unauthenticated metrics API, SPA token/source-map class plus related brand tools. HIGH 5 · MEDIUM 4.

Pinossa tässä ajossa

Komponentti	Käytössä	Huom
ParviClaw Core + AWP	KYLLÄ (lab)	pack engagementissa
ParviSight browser	osittain	HTTP walk
PayBotFin Witness live	sopimuksen mukaan	rehellinen laajuus

Havainnot

Jokainen havainto: ongelma, missä, vaikutus, omistaja, PoC, korjaus, validointi.

NO-H1

Public Swagger UI on BFM prod API

KORKEA

Ongelma

https://bfm-app-prod.azurewebsites.net/swagger/index.html returns 200 Swagger UI for the production “Burn for Money” API. last_reprobe=2026-07-31.

Public engineering/tooling yields free recon (versions, configs, APIs).

Missä

https://bfm-app-prod.azurewebsites.net/swagger/index.html · https://bfm-app-prod.azurewebsites.net

Mitä hyökkääjä tai agentti-hakkeri voi tehdä

Human: Public eng surface on noaignite.com expands attacker recon.
Agent (LLM+tools): Probe APIs/health in loops; correlate versions with CVEs.
If invasive/destructive: Source/secrets/CI risk if auth weak later. L3 only proves public exposure.

Kenen vastuulla

Noaignite — turva / tuote / infra (vahvista omistaja)

PoC (todiste — ei korjaa)

Read-only. Does not change the system.

curl -sSI 'https://bfm-app-prod.azurewebsites.net/swagger/index.html'

Miten korjata

Remove from public DNS or require VPN/SSO; disable anonymous APIs; re-test from the public internet on noaignite.com.

Miten validoida korjaus

Residual public exposure continues until closed.

NO-H2

Unauthenticated org metrics API

KORKEA

Ongelma

https://noaignite.com/ — What / evidence: GET /public/api/totalnumbers → 200 live JSON (distance/time/money/engagement). Fix: Auth or aggregate only last_reprobe=2026-07-31.

Public metrics leak ops data useful for targeting.

Missä

https://noaignite.com/ · https://noaignite.com

Mitä hyökkääjä tai agentti-hakkeri voi tehdä

Human: Public metrics surface on noaignite.com expands attacker recon.
Agent (LLM+tools): Keep surface in continuous recon.
If invasive/destructive: Escalate if second bug/credential. L3 public-max is read-only.

Kenen vastuulla

Noaignite — turva / tuote / infra (vahvista omistaja)

PoC (todiste — ei korjaa)

Read-only. Does not change the system.

curl -sSI 'https://noaignite.com/'

Miten korjata

Require auth on metrics/Grafana/Prometheus or put behind VPN; never expose raw metrics publicly.

Miten validoida korjaus

Exposure remains until closed.

NO-H3

BFM SPA + historical Contentful preview token risk

KORKEA

Ongelma

Client bundle https://bfm.noaignite.com/static/js/main.ef1f505e.js contains Contentful SDK init: - space: "r9sx20y0suod" - accessToken: "0cfdeec8…927fc4" (full value in bundle) - host: "preview.contentful.com" (Preview API, not delivery CDN) The matching source map (main.ef1f505e.js.map, ~8.5 MB) is also publicly downloadable, making reverse-engineering trivial. last_reprobe=2026-07-31.

Public brand surface on noaignite.com expands recon until closed.

Missä

https://bfm.noaignite.com/static/js/main.ef1f505e.js · https://bfm.noaignite.com · https://preview.contentful.com

Mitä hyökkääjä tai agentti-hakkeri voi tehdä

Human: Public edge surface on noaignite.com expands attacker recon.
Agent (LLM+tools): Keep surface in continuous recon.
If invasive/destructive: Escalate if second bug/credential. L3 public-max is read-only.

Kenen vastuulla

Noaignite — turva / tuote / infra (vahvista omistaja)

PoC (todiste — ei korjaa)

Read-only. Does not change the system.

curl -sSI 'https://bfm.noaignite.com/static/js/main.ef1f505e.js'

Miten korjata

Remove unnecessary public hosts on noaignite.com DNS or enforce strong auth/WAF; re-test from internet.

Miten validoida korjaus

Residual public exposure continues until closed.

NO-H4

OIDC metadata / implicit grant surface

KORKEA

Ongelma

https://noaignite.com/ — What / evidence: OpenID config advertised on API (deep + prior). Fix: Auth code+PKCE only last_reprobe=2026-07-31.

Public auth/federation edges expand phishing and IdP attack surface.

Missä

https://noaignite.com/ · https://noaignite.com

Mitä hyökkääjä tai agentti-hakkeri voi tehdä

Human: Public auth surface on noaignite.com expands attacker recon.
Agent (LLM+tools): Keep surface in continuous recon.
If invasive/destructive: Escalate if second bug/credential. L3 public-max is read-only.

Kenen vastuulla

Noaignite — turva / tuote / infra (vahvista omistaja)

PoC (todiste — ei korjaa)

Read-only. Does not change the system.

curl -sSI 'https://noaignite.com/'

Miten korjata

Remove non-prod auth edges from public DNS; prefer auth code+PKCE; conditional access; minimize public metadata where possible.

Miten validoida korjaus

Exposure remains until closed.

NO-H5

deskreservation public

KORKEA

Ongelma

GET https://bfm-app-prod.azurewebsites.net/.well-known/openid-configuration → 200** JSON documenting issuer, authorization/userinfo endpoints, JWKS URI, grant types (implicit supported). last_reprobe=2026-07-31.

Public auth/federation edges expand phishing and IdP attack surface.

Missä

https://bfm-app-prod.azurewebsites.net/.well-known/openid-configuration · https://bfm-app-prod.azurewebsites.net

Mitä hyökkääjä tai agentti-hakkeri voi tehdä

Human: Public auth surface on noaignite.com expands attacker recon.
Agent (LLM+tools): Keep surface in continuous recon.
If invasive/destructive: Escalate if second bug/credential. L3 public-max is read-only.

Kenen vastuulla

Noaignite — turva / tuote / infra (vahvista omistaja)

PoC (todiste — ei korjaa)

Read-only. Does not change the system.

curl -sSI 'https://bfm-app-prod.azurewebsites.net/.well-known/openid-configuration'

Miten korjata

Remove non-prod auth edges from public DNS; prefer auth code+PKCE; conditional access; minimize public metadata where possible.

Miten validoida korjaus

Residual public exposure continues until closed.

NO-M1

test.noaignite.com Netlify public

KESKI

Ongelma

test.noaignite.com Netlify public (surface: https://noaignite.com/). last_reprobe=2026-07-31.

Public brand surface on noaignite.com expands recon until closed.

Missä

https://noaignite.com/ · https://test.noaignite.com · https://noaignite.com

Mitä hyökkääjä tai agentti-hakkeri voi tehdä

Human: Public edge surface on noaignite.com expands attacker recon.
Agent (LLM+tools): Keep surface in continuous recon.
If invasive/destructive: Escalate if second bug/credential. L3 public-max is read-only.

Kenen vastuulla

Noaignite — turva / tuote / infra (vahvista omistaja)

PoC (todiste — ei korjaa)

Read-only. Does not change the system.

curl -sSI 'https://noaignite.com/'

Miten korjata

Remove unnecessary public hosts on noaignite.com DNS or enforce strong auth/WAF; re-test from internet.

Miten validoida korjaus

Re-run PoC from public internet until closed (noaignite.com).

NO-M2

retailor 401 public edge

KESKI

Ongelma

auth-required but internet-reachable (surface: https://noaignite.com/). last_reprobe=2026-07-31.

Public brand surface on noaignite.com expands recon until closed.

Missä

https://noaignite.com/ · https://noaignite.com

Mitä hyökkääjä tai agentti-hakkeri voi tehdä

Human: Public edge surface on noaignite.com expands attacker recon.
Agent (LLM+tools): Keep surface in continuous recon.
If invasive/destructive: Escalate if second bug/credential. L3 public-max is read-only.

Kenen vastuulla

Noaignite — turva / tuote / infra (vahvista omistaja)

PoC (todiste — ei korjaa)

Read-only. Does not change the system.

curl -sSI 'https://noaignite.com/'

Miten korjata

Remove unnecessary public hosts on noaignite.com DNS or enforce strong auth/WAF; re-test from internet.

Miten validoida korjaus

Re-run PoC from public internet until closed (noaignite.com).

NO-M3

Thin marketing CSP / missing nosniff samples

KESKI

Ongelma

Thin marketing CSP / missing nosniff samples (surface: https://noaignite.com/). last_reprobe=2026-07-31.

Weak browser security headers increase impact of XSS/clickjacking/MITM.

Missä

https://noaignite.com/ · https://noaignite.com

Mitä hyökkääjä tai agentti-hakkeri voi tehdä

Human: Public headers surface on noaignite.com expands attacker recon.
Agent (LLM+tools): Keep surface in continuous recon.
If invasive/destructive: Escalate if second bug/credential. L3 public-max is read-only.

Kenen vastuulla

Noaignite — turva / tuote / infra (vahvista omistaja)

PoC (todiste — ei korjaa)

Read-only. Does not change the system.

curl -sSI 'https://noaignite.com/' | egrep -i 'strict-transport|content-security|x-frame|x-content'

Miten korjata

Add/tighten HSTS, CSP, XFO, nosniff, Referrer-Policy, Permissions-Policy on https://noaignite.com/.

Miten validoida korjaus

Re-run PoC from public internet until closed (noaignite.com).

NO-M4

Careers multi-country hosts

KESKI

Ongelma

Careers multi-country hosts (surface: https://noaignite.com/). last_reprobe=2026-07-31.

Public brand surface on noaignite.com expands recon until closed.

Missä

https://noaignite.com/ · https://noaignite.com

Mitä hyökkääjä tai agentti-hakkeri voi tehdä

Human: Public edge surface on noaignite.com expands attacker recon.
Agent (LLM+tools): Keep surface in continuous recon.
If invasive/destructive: Escalate if second bug/credential. L3 public-max is read-only.

Kenen vastuulla

Noaignite — turva / tuote / infra (vahvista omistaja)

PoC (todiste — ei korjaa)

Read-only. Does not change the system.

curl -sSI 'https://noaignite.com/'

Miten korjata

Remove unnecessary public hosts on noaignite.com DNS or enforce strong auth/WAF; re-test from internet.

Miten validoida korjaus

Re-run PoC from public internet until closed (noaignite.com).

Liitteet (AWP + Core)

Oikea pack L3 max retestistä 2026-07-31 (public-max, ei-tuhoava). Jokaisella tiedostolla on kuvateksti.

1) awp-receipt.json — AWP-krypto

Mikä se on: allekirjoitettu Agent Witness Protocol -kuitti (offline-tarkistettava).
Mitä se todistaa: meidän testi-/engagement-lokimme eheyden.
Mitä se EI ole: ei yksin todista bugia hostissanne (se on kunkin havainnon PoC).
→ lataa awp-receipt.json

2) leaves.jsonl — engagement-päiväkirja

→ lataa leaves.jsonl · leaf-chain.txt (PASS)

3) retest-raw.json — HTTP-probet

→ lataa retest-raw.json

4) agentic-walk.json + core-export

agentic-walk.json · core-export.json · kansio

Miten AWP:ta käytetään / varmennetaan (open-source)

npx agent-witness-protocol verify awp-receipt.json

PASS (rehellisesti): kuitin allekirjoitus ja Merkle-todiste ok — testiloki on ehjä.
PASS ei tarkoita: että tuotantobugi on korjattu, tai että PayBotFin live-witness oli käytössä (local_awp_dev / DEV_LAB).

Korjausjärjestys tiimille

Sulje HIGH-julkiset altistukset ensin (auth / VPN / DNS).
Korjaa MEDIUM-otsikot, postikäytäntö ja non-prod.
Uudelleentestaa PoC:t julkisesta netistä kunnes kiinni.
Arkistoi AWP/evidence auditointia ja retestiä varten.