Pentest pack
External security review needs a clean runbook, not scattered screenshots
This pack defines the exact Flow surfaces, evidence requirements and remediation rules for an independent pentest or enterprise security review.
Decision state
Ready for external review
Customer-facing controls are present. Final enterprise claim remains pending until a third party or independent reviewer completes test, remediation and retest closure.
5
review scopes
5
closure rules
4
proof commands
Scope
What must be tested
Launcher, chat, callback, form, upload and attribution endpoints
Evidence: CORS/origin proof, rate-limit proof, malformed payload proof, upload rejection proof
Tenant isolation, role permissions, admin routes and direct URL access
Evidence: access matrix, tenant-bound API samples, forbidden-route proof, audit log entries
Checkout return paths, payment verification, proposal signing and customer portal
Evidence: payment state trace, signature audit trail, replay/idempotency proof, sensitive-data redaction
CRM/helpdesk/PMS connectors, webhook replay, provider diagnostics and secret rotation
Evidence: webhook signature proof, retry/reconciliation proof, rotation sweep report, provider failure handling
Export/delete, retention, public status, incident history and compliance surfaces
Evidence: DPA pack, retention decision, export/delete trace, incident communication proof
Remediation
Closure rules
- Every finding gets severity, owner, affected tenant/surface, exploitability, fix PR, retest result and sign-off.
- Critical/high findings block enterprise launch claim until fixed and retested.
- Medium findings need owner and dated mitigation plan before pilot expansion.
- Low findings can ship with accepted-risk note if customer data is not exposed.
- No proof artifact may include live secrets, raw cookies, private customer PII or provider credentials.
Proof commands
Run after reviewer evidence exists
npm run gate:flow:external-proof-executorpowershell -NoProfile -ExecutionPolicy Bypass -File ./scripts/flow-evidence-archive-surface-smoke-live.ps1npm run gate:flow:release-secrets-onboarding-verify:requirednpm run gate:flow:release-ultimate-gate