Executive Security Report
Northwind Bakery Supply Co.: Wholesale Ordering Portal
| Prepared for | Dana Whitfield, Owner, Northwind Bakery Supply Co. |
| Application | Wholesale ordering portal (app.example.com) |
| Testing window | September 14, 2026 to September 18, 2026 |
| Report date | September 25, 2026 |
| Assessor | Isaiah R. (9mmPterodactyl) |
| Companion document | Developer Report (technical details for your development team) |
This report is written for owners and decision makers. It explains what was found and what it means for the business, in plain English. Technical details, evidence, and step-by-step fix instructions are in the separate Developer Report.
1. Summary
Northwind asked for an independent security review of your wholesale ordering portal to find weaknesses before an attacker does. Over five days, I tested the application by hand, the way a real attacker would, without damaging any data or disrupting the service.
The portal has a solid foundation. Logins are handled well, and the most common serious attack on web applications (which lets attackers steal data straight out of a database) did not work anywhere I tried it. That is a genuine strength and worth saying first.
The bottom line: three issues need attention soon. One lets any logged-in customer read every other customer's invoices, including your negotiated prices. One lets an attacker reach parts of your internal cloud systems through a feature that imports logos. And one lets an outsider, with no account at all, run hidden actions inside a staff member's admin screen. None of these requires special skill to exploit. All three are fixable, and a retest is included once your team addresses them.
2. Overall Risk Rating
The portal has several issues that a motivated attacker could use without much effort, and at least one exposes sensitive customer and pricing information. None rose to the most severe "Critical" level, but the combination warrants prompt action.
| Rating | What it means |
|---|---|
| Critical | Serious harm is likely and easy to cause. Act immediately. |
| High | Serious harm is possible. Fix as soon as possible. |
| Medium | Harm is possible but limited or harder to cause. Fix soon. |
| Low | Minor risk. Fix during normal maintenance. |
Issues found
| Rating | Number of issues |
|---|---|
| Critical | 0 |
| High | 2 |
| Medium | 3 |
| Low | 1 |
| Total | 6 |
3. Key Findings and Business Impact
1. Customers can read each other's invoices
Rating:
What we found: Any logged-in customer can view the invoices of every other customer, simply by changing a number in a web address. The invoices include business names, contact details, order history, and the prices you charge each customer.
Why it matters to the business: A competitor could sign up as a customer and quietly download your entire customer list and your pricing. Exposing one customer's billing details to another also damages trust and may trigger legal reporting duties about customer data.
2. A logo feature can be used to reach your internal systems
Rating:
What we found: The feature that imports a company logo from a web address can be redirected to point at your own internal cloud systems instead of a logo. During testing it reached an internal service that hands out access keys. I confirmed it was reachable and stopped there, as agreed, without taking anything.
Why it matters to the business: This is the kind of weakness that can lead to a much larger breach, because it can expose the keys to your cloud environment. It should be closed quickly even though no harm was done during testing.
3. An outsider can run hidden actions inside a staff admin screen
Rating: by the standard score, but I rate this High priority
What we found: By combining two smaller weaknesses, someone with no account at all can submit a booby-trapped support request. When a staff member later opens that request in the admin tool, hidden instructions run inside their screen using their staff access. A separate weakness also lets attackers craft links that appear to come from your own website, which makes scam emails more convincing.
Why it matters to the business: Staff accounts have far more power than customer accounts. An attacker who can act through a staff member's screen could potentially view or change a great deal of information. Because no account is needed and staff are the target, I recommend treating this with the same urgency as the two High findings.
4. A one-time discount code can be used more than once
Rating:
What we found: Discount codes meant to be used only once can be applied repeatedly.
Why it matters to the business: Promotional codes could be reused to take discounts you did not intend to give, which eats into revenue, especially if a "first order" code is shared online.
5. A profile name field can carry hidden instructions to teammates
Rating:
What we found: The display-name field is not cleaned before it is shown to other people on the same order. Hidden instructions placed in a name can run in the screens of teammates and staff who view that order.
Why it matters to the business: The reach is narrower than finding 3 (it needs an account and only affects people sharing an order), but it is the same class of problem and should be fixed alongside it.
6. Two protective settings are switched off
Rating:
What we found: Two standard browser-protection settings are missing from your sites. These are hardening gaps rather than open doors.
Why it matters to the business: On their own they pose little risk, but turning them on is quick and closes off avenues that attackers sometimes combine with other tricks.
4. Prioritized Recommendations
Do now (within 1–2 weeks)
- Stop customers from viewing invoices that are not theirs (finding 1).
- Lock down the logo-import feature so it cannot reach internal systems (finding 2).
- Fix the two weaknesses behind the staff admin issue: block web links that point off your site, and clean staff-facing content so hidden instructions cannot run (finding 3).
Do soon (within 30 days)
- Enforce one-time discount codes at the point of purchase (finding 4).
- Clean the display-name field everywhere it is shown (finding 5).
Ongoing good practice
- Switch on the two missing protective settings (finding 6).
- Once fixes are deployed, schedule the included retest so I can confirm each issue is resolved.
5. Scope and Testing Window
What was tested
- The customer ordering portal (
app.example.com) - The system behind it that the portal talks to (
api.example.com) - The staff admin portal (
admin.example.com), using a staff test account you provided
What was not tested
- Attempts to overload or shut down the service (denial-of-service testing)
- Tricking staff by phone or email (social engineering)
- Physical access to offices or equipment
- Services run by outside companies, such as your payment processor and email provider
- Live payment transactions (checkout was tested up to, but not through, the payment step)
Testing window
Testing took place from September 14 to September 18, 2026. All testing was approved by Northwind in writing beforehand and stayed within the agreed scope. The staff admin test in finding 3 was arranged in advance with your support lead.
How testing was done
- Hands-on testing by a security professional, following the widely used OWASP Top 10 list of common web risks
- Careful, non-destructive methods: no data was deleted and the service was not disrupted
- Test customer and staff accounts were provided by Northwind
6. What Happens Next
- Share the Developer Report with the people who maintain the portal. It has the technical detail and a specific fix for each item.
- Fix the issues in the order listed in Section 4.
- When the fixes are in place, contact me to schedule the included retest. I will confirm each issue is resolved and update both reports.
7. Important Notes
This review is a snapshot of the application during the testing window. New features, updates, or configuration changes made afterward may introduce new risks. Not finding an issue does not guarantee it does not exist. Testing was limited to the agreed scope and time.
This report is confidential and intended only for Northwind Bakery Supply Co. (Sample document; Northwind Bakery Supply Co. is fictional.)