Twoday L3 — teaser preview
8 HIGH · 4 MEDIUM. Severe risks are on the public surface. This teaser shows counts and titles. The FULL report unlocks proof links, attacker/agent impact, owner, PoC, fix, and va
Summary (teaser)
This is not “just a technical PDF”
A hacker uses these findings as a map. A hacker agent runs the same playbook in a 24/7 loop. Teaser = severity. FULL = proof + impact + fix.
recon → invasion → destructive · detail in FULLSevere risks are on the public surface. This teaser shows counts and titles. The FULL report unlocks proof links, attacker/agent impact, owner, PoC, fix, and validation — so the team acts.
Stack in this run
| Component | Included? | Note |
|---|---|---|
| Sentinel L3 | YES | public-max |
| ParviClaw Core + AWP | YES (lab) | full pack in FULL |
| ParviSight | partial | as run |
| PayBotFin Witness | as engaged | honest scope in FULL |
HIGH findings — locked in teaser
AOS prod/dev/staging + runtime-env secrets
HIGHMetis Chat Open WebUI public
HIGHGitLab public (gitlab.fi.twoday.com)
HIGHJira public (jira.twoday.com)
HIGHInsight Flow prod+dev public
HIGHlut.twoday.com IIS 500
HIGHContracts Zefort public
HIGHThin marketing CSP
HIGHMEDIUM findings — short preview
DMARC quarantine not reject
MEDIUMDMARC quarantine not reject Full impact, PoC, owner and fix → FULL report.
Large product host estate
MEDIUMLarge product host estate Full impact, PoC, owner and fix → FULL report.
HubSpot sourcemaps
MEDIUMHubSpot sourcemaps Full impact, PoC, owner and fix → FULL report.
Permissions-Policy gaps
MEDIUMPermissions-Policy gaps Full impact, PoC, owner and fix → FULL report.
AWP + Core annexes (preview)
In FULL each file has captions (what it is / what it proves / what it is not) + how to run npx agent-witness-protocol verify.