Sample report · 29 October 2026 · Bardstar
Sample security report: Invoicer, a demo app
This is a full Bardstar review of a small invoicing app that we built and own, so we could publish everything. It is an example, not a client. Every finding below is real on that demo app, was proven with a real request, fixed, and tested again.
The result
9 problems: 5 Critical, 2 High, 1 Medium, 1 Low. All 9 fixed and retested. The worst let anyone on the internet read every customer’s invoices and uploaded ID documents, read every user’s email from an open admin endpoint, unlock the paid plan without paying, and use a master key that was sitting in the website’s own code.
| ID | Severity | What a stranger could do | After |
|---|---|---|---|
| F-01 | Critical | Read and change every user’s invoices from any account | Fixed |
| F-02 | Critical | Use a master key shipped in the website code to bypass every rule | Fixed |
| F-03 | Critical | Fake a payment to unlock the paid plan for free | Fixed |
| F-05 | Critical | Open any customer’s uploaded ID document with a guessable link | Fixed |
| F-06 | Critical | Read every user’s email and the revenue total with no login | Fixed |
| F-04 | High | Set their own price at checkout | Fixed |
| F-07 | High | Make the AI assistant fetch another user’s invoices | Fixed |
| F-08 | Medium | Guess passwords without limit; reuse a reset link that never expires | Fixed |
| F-09 | Low | Read internal error details that help an attacker | Fixed |
What the scanners missed
We also ran the standard free scanners. They flagged a few key-like strings and some build-tool advisories. They found none of the 9 problems above. Every one came from testing the running app with two accounts, a forged payment and an anonymous visitor. That is the gap a review closes.
What’s inside the full report
- A plain-English summary a non-technical founder can read in two minutes.
- For each finding: what a stranger could do, the exact proof, why it happens, the fix, and the retest.
- What scanners found and missed, what was not tested, and next steps.
- A one-page security summary for investors (the Review Plus extra).
Honest limits: the demo runs locally with a small database that stands in for a hosted one, and its AI assistant uses a fixed stand-in model, so that finding is proven at the tool boundary. The report says so where it matters.