pentest-report

name	pentest-report
description	Use when aggregating findings from multiple security scans (secret-scan, dependency-scan, image-scan, DAST, cloud-posture, IAM review) into a single severity-grouped report for the security team or stakeholders, or "/pentest-report".
tools	["cursor","claude","copilot"]

pentest-report

When to use

• End of a security sweep — combine all scanner outputs into one document.
• Pre-handoff to a security team / auditor.
• Quarterly security posture review.
• "/pentest-report"

Preconditions

• One or more scan outputs in the conversation or filesystem (JSON or markdown).
• Authorization context (what was tested, by whom, when, with what permission).
• Owner names for follow-ups.

Procedure

1. Normalize all findings to one shape:

   id: <stable-id>     # e.g. CVE-id, finding hash
   source: gitleaks | trivy | prowler | zap | manual | …
   severity: critical | high | medium | low | info
   title: <short>
   where: <file:line | URL | ARN | resource id>
   evidence: <redacted snippet>
   why: <attack path, 1–2 sentences>
   fix: <concrete remediation>
   references: [CWE-…, CVE-…, OWASP A…]
   owner: <team / person>
   sla: <date by severity>
   

2. Deduplicate. The same vulnerable lib will show in trivy + osv-scanner + npm audit. Pick the most actionable record.

3. Bucket and sort. Critical → High → Medium → Low → Info. Within each, group by component (frontend, backend, infra, cloud).

4. Set SLAs by severity (default; user can override):

   • Critical: 24h
   • High: 7d
   • Medium: 30d
   • Low: 90d
   • Info: best-effort

5. Compute deltas if a previous report exists: new / fixed / still-open / regressed.

6. Add an executive summary — 5 sentences max, no jargon, ship/no-ship recommendation.

7. Sanitize. No raw secrets, tokens, PII, customer ids, or third-party data. Redact (AKIA****WXYZ, user_****1234).

Output

# Security assessment — <service / scope>

**Date:** <YYYY-MM-DD>
**Author:** pentest agent
**Scope:** repo `<name>` @ commit `<sha>`, image `<image:tag>`, AWS account `<id>`, staging `https://<host>`
**Authorization:** <localhost | staging owner-asserted | prod ref:<ticket>>
**Tools:** gitleaks 8.x, trivy 0.50, prowler 4.x, zap-baseline 2.14, semgrep <ver>

## Executive summary

<5 sentences, plain English. Highlight the top risk and the recommendation.>

**Recommendation:** ship | mitigate-then-ship | block

## Findings overview

| Severity | Count | New | Fixed since last | SLA |
|---|---|---|---|---|
| Critical | 2 | 1 | 0 | 24h |
| High     | 5 | 2 | 1 | 7d |
| Medium   | 11 | 4 | 3 | 30d |
| Low      | 18 | 6 | 4 | 90d |
| Info     | 22 | – | – | – |

## Critical findings

### C-001 — Exposed `.git/` on staging
- **Source:** zap-baseline
- **Where:** `https://staging.example.com/.git/config`
- **Why:** full source + history downloadable; secrets in history exploitable.
- **Fix:** block `/.git/` at CDN; rebuild deploy artifact without `.git`; rotate any historical secrets.
- **Owner:** Platform team
- **SLA:** 2026-04-28
- **Refs:** CWE-538

### C-002 — IAM user `legacy-deploy` has `*:*`
- (full record)

## High findings
…

## Medium findings
…

## Out of scope / not tested
- Authenticated user-to-user IDOR (no test accounts provided).
- Mobile clients.
- Third-party SaaS integrations (need their cooperation).

## Compliance snapshot
- CIS AWS 2.0: 78% pass
- OWASP ASVS L1: 85% pass; gaps in V2.1, V4.1.

## Trend
- Last report (2026-01-15): 14 open. Today: 38 open. **Regression** driven by new public endpoint and new dependencies.

## Recommended program improvements
- [ ] Add `gitleaks` pre-commit hook (prevents C-001 class).
- [ ] Add `osv-scanner` to CI (blocks Critical/High runtime CVEs).
- [ ] Quarterly prowler scan with diff vs prior.
- [ ] Threat-model template for every new public endpoint.

---
**Distribution:** security@, eng-leads@. Do not forward externally without redaction review.

Guardrails

• One finding = one row. Don't bundle "fix all CVEs" into one entry.
• Every finding has a fix and an owner. No orphaned findings.
• Mark "accepted risk" entries with justification + expiry; re-surface them on the next report when expiry hits.
• Prefer linking to scanner artifacts (HTML reports, SARIF) rather than pasting massive log dumps.
• Never publish to a public location. Internal channels + access-controlled storage only.