# Flow Pentest Pack

Decision: ready for external review; final enterprise claim pending independent test, remediation and retest closure.

## Scope

### Public widget and embed
- Target: Launcher, chat, callback, form, upload and attribution endpoints
- Evidence: CORS/origin proof, rate-limit proof, malformed payload proof, upload rejection proof

### Tenant and admin access
- Target: Tenant isolation, role permissions, admin routes and direct URL access
- Evidence: access matrix, tenant-bound API samples, forbidden-route proof, audit log entries

### Payments and OfferFlow
- Target: Checkout return paths, payment verification, proposal signing and customer portal
- Evidence: payment state trace, signature audit trail, replay/idempotency proof, sensitive-data redaction

### Integrations and webhooks
- Target: CRM/helpdesk/PMS connectors, webhook replay, provider diagnostics and secret rotation
- Evidence: webhook signature proof, retry/reconciliation proof, rotation sweep report, provider failure handling

### Trust and compliance
- Target: Export/delete, retention, public status, incident history and compliance surfaces
- Evidence: DPA pack, retention decision, export/delete trace, incident communication proof

## Remediation rules
- [ ] Every finding gets severity, owner, affected tenant/surface, exploitability, fix PR, retest result and sign-off.
- [ ] Critical/high findings block enterprise launch claim until fixed and retested.
- [ ] Medium findings need owner and dated mitigation plan before pilot expansion.
- [ ] Low findings can ship with accepted-risk note if customer data is not exposed.
- [ ] No proof artifact may include live secrets, raw cookies, private customer PII or provider credentials.

## Proof commands
- `npm run gate:flow:external-proof-executor`
- `powershell -NoProfile -ExecutionPolicy Bypass -File ./scripts/flow-evidence-archive-surface-smoke-live.ps1`
- `npm run gate:flow:release-secrets-onboarding-verify:required`
- `npm run gate:flow:release-ultimate-gate`