Meridian customer portal

Penetration test report

ENGAGEMENTSNT-8C24A1October 3, 2026

Validated findings04Across 4 control areas

Needs priority attention02Open critical & high findings

Remediation verified004 remaining to resolve

Severity distribution

1 Critical1 High2 Medium0 Low

Executive summary

Assessment complete

Resolve the authorization gaps before release.

Magier AI validated 4 security findings on staging.meridian-commerce.example. 2 open issues require priority remediation because of the impact on account permissions and customer data. Testing used 2 approved test identities within the agreed scope.

Technical findings

4 validated

What was observed

The invitation endpoint accepted an administrator role from a member account. The invited test user received permissions reserved for account administrators.

Supporting record
Record / captured at	Evidence type	Recorded observation
`PT_8C24A1-F2`2026-10-03 14:32:40 UTC	HTTP exchange	201 Created · Administrator invitation

Business impact

A member could grant administrative access within its own account, including access to team settings and billing. Validation was limited to an isolated test account and an approved test invitee.

Expected behavior403 Forbidden · Member cannot grant admin

Observed behavior201 Created · Administrator invitation

RequestApproved test session

POST /api/team/invitations HTTP/1.1
Host: staging.meridian-commerce.example
Authorization: Bearer [REDACTED MEMBER SESSION]
Content-Type: application/json

{"email":"alex.chen@meridian-commerce.example","role":"admin"}

Response201 Created

HTTP/1.1 201 Created
Content-Type: application/json

{"invite_id":"invtn_8c4912","role":"admin","account_id":"acct_mrc_7314"}

Observed October 3, 2026 · Credential values masked

Scope & coverage

Approved targetsstaging.meridian-commerce.exampleTest account

Testing was limited to these hosts. Related assets require a separate scope approval.

Application mapping

Reachable application routes and API entry points

Covered

Account isolation

Ownership checks across two approved identities

Covered

Session controls

Session lifecycle and sign-out invalidation

Covered

Privilege boundaries

Role assignment in an isolated test account

Covered

Testing approach

01Map & establish access

Identify application entry points and confirm the supplied test context.

02Validate within scope

Compare the suspected behavior with control requests. Request approval before cross-account checks or test-data changes.

03Preserve & verify

Attach masked request evidence and actionable fixes. Retest each finding in a fresh session using its original scope.

This report describes the behavior validated during this engagement. Untested routes, identities, and control areas are outside its conclusions.