keywarden/evidence/templates/security-test-report.md

Security Test Report

How To Complete

1. Fill metadata fields and keep them aligned with the evidence run ID.
2. For each test row, set Pass/Fail to PASS, FAIL, PARTIAL, or N/A.
3. Put concrete observations in Actual (status code, rejection text, behavior).
4. Always link an evidence artifact path for each completed row.
5. Keep findings evidence-backed; avoid conclusions without artifacts.

Metadata

Date (UTC): Environment URL: Commit: Run ID: Tester:

Scope

• Authentication and session handling
• Authorization boundaries
• Token handling
• Input validation
• File/command safety
• WebSocket controls

Test Cases

ID	Area	Test	Expected	Actual	Pass/Fail	Evidence Path
SEC-01	Input validation	Submit malformed SSH key payload	4xx with validation error
SEC-02	Auth bypass	Call admin API as non-admin	403
SEC-03	Token misuse	Use revoked/invalid agent token	401/403
SEC-04	Object permission	Access server not granted to user	403
SEC-05	Session/CSRF	Unsafe method without CSRF/session validity	Blocked
SEC-06	File handling	Upload invalid file/path content	Rejected safely
SEC-07	Command injection	Shell input escaping checks	No command injection path
SEC-08	WebSocket shell auth	Open shell WS without scope	Rejected
SEC-09	Host key verification	Shell verifies host identity	Verified or documented gap

Findings

• High:
• Medium:
• Low:

Follow-up Actions