veilscan
Get started
Features Pricing About Blog FAQ Compare Use Cases Get started free →
Demo report — Findings and data below are fictional. They illustrate what a real VeilScan report contains.
Scan complete · 3 June 2026

Security report — acmecorp.com

50-node pipeline·Duration: 1h 47m·Subdomains discovered: 23
This scan found 2 critical issues that need immediate attention, including a verified attack path — a chain of real vulnerabilities an attacker could follow from the public internet to a damaging outcome. 3 high severity issues should also be addressed within 7 days.
Risk score
7.2/10
High risk
Critical
2
Fix within 24h
High
3
Fix within 7 days
Medium
2
Fix within 30 days
Low
1
Review in cycle
Total
8
all severity
Attack path — verified chain
VERIFIED CHAIN
Step 1 · Critical
SQL Injection
api.acmecorp.com
→
Step 2 · Critical
Exposed .env file
app.acmecorp.com
→
Step 3 · High
Admin panel access
admin.acmecorp.com
What this means

An attacker exploits the SQL injection on the user search endpoint to extract database credentials. The exposed .env file independently confirms the admin panel password. Using these credentials, the attacker logs into the admin panel without authentication — gaining full control over customer data and application configuration.

Business consequence: Full customer database exposed. Unauthenticated admin access confirmed. GDPR breach notification required within 72 hours. Estimated regulatory exposure: Article 83 fine applicable.

Actionable findings
8 issues · 4 shown
SQL Injection — User Search Endpoint
api.acmecorp.com/users/search
Critical ✓ Confirmed exploit web_vulnerability
BIS 9.1

The q parameter on the user search endpoint is injectable. Error-based and boolean-blind extraction confirmed. An unauthenticated attacker can dump the full users table including email addresses, password hashes, and session tokens.

Reproduction
curl -s "https://api.acmecorp.com/users/search?q=' OR '1'='1'--" HTTP/2 200 Content-Type: application/json {"users":[{"id":1,"email":"admin@acmecorp.com","role":"admin"},{"id":2,"email":"ceo@acmecorp.com","role":"owner"...
Remediation
Use parameterised queries or prepared statements for all database operations. Apply input validation and a WAF rule to block SQLi patterns. Rotate all database credentials immediately.
ISO 27001 A.14.2.5 GDPR Art. 32 PCI DSS 6.3.3 SOC 2 CC6.1
Exposed .env file with live credentials
app.acmecorp.com/.env
Critical ✓ Confirmed exploit sensitive_file
BIS 9.4

The application's .env file is publicly accessible with no authentication. It contains live Stripe secret keys, a database connection string with credentials, and an admin panel password.

Reproduction
curl -s "https://app.acmecorp.com/.env" HTTP/2 200 Content-Type: text/plain APP_ENV=production STRIPE_SECRET_KEY=sk_live_4xKqR... DATABASE_URL=postgres://admin:P@ssw0rd123@db.acmecorp.com/prod ADMIN_PASSWORD=Acme2024!
Remediation
Block .env access at the web server level immediately. nginx: location ~ /\.env { deny all; }. Rotate all exposed credentials — Stripe key, database password, and admin password.
ISO 27001 A.12.6.1 GDPR Art. 32 PCI DSS 6.4.1 Cyber Essentials: Secure Config
TLS 1.0 still enabled
api.acmecorp.com:443
High ✓ Confirmed misconfiguration ssl
BIS 6.2

TLS 1.0 is enabled on the API server. Deprecated in RFC 8996 (2021) due to POODLE and BEAST. An attacker in a network-adjacent position can downgrade TLS sessions and intercept encrypted traffic.

Reproduction
openssl s_client -connect api.acmecorp.com:443 -tls1 CONNECTED(00000003) Protocol: TLSv1.0 Cipher: AES128-SHA Verify return code: 0 (ok)
Remediation
Disable TLS 1.0 and 1.1 in your web server configuration. Enable TLS 1.2 and 1.3 only. nginx: ssl_protocols TLSv1.2 TLSv1.3;
ISO 27001 A.18.1.3 PCI DSS 4.2.1 Cyber Essentials: Secure Config
Missing DMARC record
acmecorp.com
Medium ✓ Validated email
BIS 4.3

No DMARC DNS record exists for acmecorp.com. Without DMARC, any attacker can send spoofed email appearing to come from @acmecorp.com addresses — enabling phishing attacks that impersonate your brand.

Reproduction
dig TXT _dmarc.acmecorp.com +short (no record returned)
Remediation
Add a DMARC TXT record at _dmarc.acmecorp.com. Start with monitoring policy: v=DMARC1; p=none; rua=mailto:dmarc@acmecorp.com then tighten to p=quarantine.
ISO 27001 A.13.2.3 GDPR Art. 32 Cyber Essentials: Email
4 further findings (1 High · 1 Medium · 1 Low · 1 Informational) not shown in this demo. The full report PDF includes all findings with proof, remediation steps, and CVSS scores.
Compliance framework mapping
5 frameworks
ISO 27001:2022
A.12.6.1A.14.2.5A.18.1.3A.13.2.3
GDPR
Art. 32Art. 83Art. 33
SOC 2 Type II
CC6.1CC7.1CC8.1
PCI DSS v4.0
6.3.36.4.14.2.1
Cyber Essentials
Patch MgmtSecure ConfigAccess Control

Each finding is mapped automatically. The full PDF includes a compliance evidence pack suitable for direct auditor submission.

Scan your domain.
First report in two hours.

Free plan includes one domain and one lifetime scan. No credit card required. Paid plans add continuous monitoring, attack paths, and PDF reports.

Start free scan → See all plans
★ No credit card required★ Setup in 2 minutes★ Data stays in London