Is this a real customer report?

It is a sanitized demo-style narrative for illustration, based on authorized Autopilot engagements.

Can I publish reports publicly?

Only with secrets removed and written permission. Never expose tokens or personal data.

How do I get my own report?

Sign up, set RoE, run Quick, Standard, or Deep Autopilot, then export from the dashboard.

Sample Autopilot Report

Sanitized demo-style narrative: critical authz and secrets findings, stitched kill chains, and no LLM-only false positives.

This is a sanitized sample based on authorized Autopilot-style runs. It shows the shape of the output. It is not a substitute for your own engagement.

Findings

Example findings

CRITICAL: Token

Cloudflare bearer token in a native lib, live-validated.

CRITICAL: BOLA

Vehicle IDOR across a foreign session, oracle confirmed.

HIGH: Logic

Wallet credit forgery on an unsigned callback path.

MEDIUM: IDOR

e-Sign PDF IDOR on document ids.

Chain

Example kill chain

APK secret scan

Bearer token found in native code.

Token validation

Live check confirms privileged cloud access.

Identity signup

User A and User B minted.

Authz and logic

Object-level bypass plus wallet forgery path.

Oracles used: control request, soft-404, body diff. LLM confirmation: not used. Next: pricing, BOLA, vs scanners.

FAQ

What a confirmed Autopilot report looks like