Agentic Testari Sentinel Hub · FriendlyAI agentictestari.com

Confidential

TEASER L3 preview · unlock FULL

NoA Ignite L3 — teaser preview

5 HIGH · 4 MEDIUM. Severe risks are on the public surface. This teaser shows counts and titles. The FULL report unlocks proof links, attacker/agent impact, owner, PoC, fix, and va

Target noaignite.com Date 2026-07-29 RoE public-max Mode TEASER

5

HIGH

4

MEDIUM

0

INFO

—

OK

Summary (teaser)

This is not “just a technical PDF”

A hacker uses these findings as a map. A hacker agent runs the same playbook in a 24/7 loop. Teaser = severity. FULL = proof + impact + fix.

recon → invasion → destructive · detail in FULL

Severe risks are on the public surface. This teaser shows counts and titles. The FULL report unlocks proof links, attacker/agent impact, owner, PoC, fix, and validation — so the team acts.

Stack in this run

Component	Included?	Note
Sentinel L3	YES	public-max
ParviClaw Core + AWP	YES (lab)	full pack in FULL
ParviSight	partial	as run
PayBotFin Witness	as engaged	honest scope in FULL

HIGH findings — locked in teaser

NO-H1

Public Swagger UI on BFM prod API

HIGH

████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████

🔒 Impact · link · PoC · owner · fix in FULL

NO-H2

Unauthenticated org metrics API

HIGH

████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████

🔒 Impact · link · PoC · owner · fix in FULL

NO-H3

BFM SPA + historical Contentful preview token risk

HIGH

████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████

🔒 Impact · link · PoC · owner · fix in FULL

NO-H4

OIDC metadata / implicit grant surface

HIGH

████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████

🔒 Impact · link · PoC · owner · fix in FULL

NO-H5

deskreservation public

HIGH

████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████
████ ██████████ ████████ · ████████████ ████████ · ████ / ████████

🔒 Impact · link · PoC · owner · fix in FULL

MEDIUM findings — short preview

NO-M1

test.noaignite.com Netlify public

MEDIUM

Preview

test.noaignite.com Netlify public Full impact, PoC, owner and fix → FULL report.

NO-M2

retailor 401 public edge

MEDIUM

Preview

retailor 401 public edge Full impact, PoC, owner and fix → FULL report.

NO-M3

Thin marketing CSP / missing nosniff samples

MEDIUM

Preview

Thin marketing CSP / missing nosniff samples Full impact, PoC, owner and fix → FULL report.

NO-M4

Careers multi-country hosts

MEDIUM

Preview

Careers multi-country hosts Full impact, PoC, owner and fix → FULL report.

AWP + Core annexes (preview)

In FULL each file has captions (what it is / what it proves / what it is not) + how to run npx agent-witness-protocol verify.

In the FULL report

Open FULL report

🔒 Remediation order + PoCs + fix validation

In the FULL report

Unlock FULL