Example reports

What a CodeSecPilot report looks like.

A report lists what an attacker can do to your business, most urgent first. Each finding opens into what happens, how hard it is, why it matters, what to change, and the exact lines of code that prove it.

The three examples below are fictional. The businesses, the vulnerabilities, the file paths and the code were written to show the format; they are not scans of real companies.

Choose a business

Clinic booking software

clinic-booking @ a1f3c9e · scanned 31 Oct 2026 · Fictional example

A SaaS company provides one booking platform to independent clinics and small clinic groups. Patients browse available services and book appointments online. Each clinic has its own staff accounts and its own patient information.

Findings: 6
Critical: 2
Serious: 4
Changes to make: 3

		What can happen
	Critical	Anyone can read every clinic's patient list and appointment history.
finding 1 of 6Criticalfix family Scope every query and export to one clinic, and return only public fieldsentry `GET /appointments/search` What happens A visitor can use the public appointment search to retrieve patient names, contact details and appointment histories from other clinics. No account is needed. Their search text changes the database query, allowing it to read private records instead of returning available appointment slots. How difficult is it? The visitor needs technical knowledge to construct a useful search, but no clinic account or access to anyone's account. Once the input is known, it can be submitted through the public search endpoint.
	Critical	A patient can take over a clinic employee's account.
finding 2 of 6Criticalfix family Make each link authorize one purpose and one recordentry `POST /staff/sign-in/link` What happens The public booking flow issues a signed link containing the email entered on the booking form. The staff sign-in endpoint accepts that same kind of signed link without checking its purpose. A patient can enter a known staff email on a booking, obtain the booking link and use it to open that employee's staff account. How difficult is it? The attacker needs a public booking and a staff email address. In this fictional setup, the booking creator receives the management link directly, and staff sign-in requires no further proof after accepting the link.
	Serious	A patient can cancel someone else's appointment.
finding 3 of 6Seriousfix family Make each link authorize one purpose and one recordentry `POST /appointments/cancel` What happens The cancellation endpoint verifies that a booking link is genuine, then cancels the booking ID supplied separately in the request. A patient can keep their own valid link but substitute another booking reference. How difficult is it? The attacker needs their own booking link and another booking reference at the same clinic. This example uses sequential clinic-local references, so references near their own can be guessed.
	Serious	Staff at one clinic can download another clinic's patient list.
finding 4 of 6Seriousfix family Scope every query and export to one clinic, and return only public fieldsentry `GET /patients/export` What happens A patient export endpoint confirms that the caller is a clinic employee but takes the target clinic ID from the request. An employee of one clinic can ask it to export patient contacts for a different clinic. How difficult is it? The caller needs an ordinary staff account and another clinic's identifier. Clinic identifiers are visible in public booking-page addresses in this fictional product.
	Serious	The public calendar reveals patients' names and phone numbers.
finding 5 of 6Seriousfix family Scope every query and export to one clinic, and return only public fieldsentry `GET /calendar/availability` What happens A clinic publishes a calendar feed so visitors can see availability. The feed includes the patient's name in each booked event and their phone number in the event description. How difficult is it? No account is required. A visitor only needs the public availability-feed link displayed on the clinic's booking page.
	Serious	Removed employees can keep opening the clinic's patient list.
finding 6 of 6Seriousfix family Check staff membership on every request, not only at sign-inentry `GET /patients` What happens A clinic owner removes an employee, but the patient-list endpoint trusts the employee's existing session until it expires. It never checks whether that person's clinic membership is still active. How difficult is it? The person needs a staff session obtained before removal. They can keep using that session through the illustrated endpoint until it expires.