{
  "fixtureVersion": "guides-1",
  "commit": "d22a675deb1a91cdaaa6aad6a12893c21bb9f7aa",
  "python": "3.13.0",
  "PyJWT": "2.15.1",
  "scope": "Real loopback HTTP; actual Scantelio BOLA and leak rules; synthetic JWT issuer. No customer targets.",
  "cases": [
    {
      "case": "vulnerable:a:doc-a",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:a:doc-a/download",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:b:doc-b",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:b:doc-b/download",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:a:doc-b",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:a:doc-b/download",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:b:doc-a",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:b:doc-a/download",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:guest:doc-a",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:guest:doc-a/download",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:guest:doc-b",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:guest:doc-b/download",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "vulnerable:anonymous:doc-a",
      "expected": 401,
      "actual": 401
    },
    {
      "case": "vulnerable:anonymous:doc-a/download",
      "expected": 401,
      "actual": 401
    },
    {
      "case": "fixed:a:doc-a",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "fixed:a:doc-a/download",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "fixed:b:doc-b",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "fixed:b:doc-b/download",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "fixed:a:doc-b",
      "expected": 403,
      "actual": 403
    },
    {
      "case": "fixed:a:doc-b/download",
      "expected": 403,
      "actual": 403
    },
    {
      "case": "fixed:b:doc-a",
      "expected": 403,
      "actual": 403
    },
    {
      "case": "fixed:b:doc-a/download",
      "expected": 403,
      "actual": 403
    },
    {
      "case": "fixed:guest:doc-a",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "fixed:guest:doc-a/download",
      "expected": 200,
      "actual": 200
    },
    {
      "case": "fixed:guest:doc-b",
      "expected": 403,
      "actual": 403
    },
    {
      "case": "fixed:guest:doc-b/download",
      "expected": 403,
      "actual": 403
    },
    {
      "case": "fixed:anonymous:doc-a",
      "expected": 401,
      "actual": 401
    },
    {
      "case": "fixed:anonymous:doc-a/download",
      "expected": 401,
      "actual": 401
    },
    {
      "case": "env:vulnerable",
      "expected": "finding",
      "actual": "finding"
    },
    {
      "case": "env:spa",
      "expected": "passed",
      "actual": "passed"
    },
    {
      "case": "env:fixed",
      "expected": "passed",
      "actual": "passed"
    },
    {
      "case": "scanner-bola:vulnerable",
      "expected": "finding",
      "actual": "finding"
    },
    {
      "case": "scanner-bola:fixed",
      "expected": "passed",
      "actual": "passed"
    },
    {
      "case": "jwt:valid",
      "expected": true,
      "actual": true
    },
    {
      "case": "jwt:other audience",
      "expected": false,
      "actual": false
    },
    {
      "case": "jwt:other issuer",
      "expected": false,
      "actual": false
    },
    {
      "case": "jwt:expired",
      "expected": false,
      "actual": false
    },
    {
      "case": "jwt:missing exp",
      "expected": false,
      "actual": false
    },
    {
      "case": "jwt:tampered signature",
      "expected": false,
      "actual": false
    },
    {
      "case": "jwt:missing token",
      "expected": false,
      "actual": false
    },
    {
      "case": "jwt:valid token still needs object permission",
      "expected": false,
      "actual": false
    }
  ],
  "passed": true,
  "guide": "api-security-audit",
  "reviewedAt": "2026-11-02",
  "reviewType": "implementation verification; not independent expert certification",
  "reproduction": "See repository tests/seo and docs/seo/README.md",
  "limits": "Local controlled fixture; not a production penetration test. All accounts and revisions are synthetic.",
  "sourceHashes": {
    "tests/seo/ci-contract.mjs": "b3f77fd31359e4c456ee23233f9c28d269306234c7a1b91227a919962f0695db",
    "tests/seo/next-example.mjs": "dafc096c09eafe42e418f7fa0d2379592cdc1e9a42c805ecf11d77f48b58de9b",
    "tests/seo/dependencies.mjs": "323950ef5fdd4d4fcfd539fabe46a050944ff60c6bbae5ceb34776413b01a2bd",
    "tests/seo/performance.mjs": "9801f7dc74f96fe200e744d4df85924437e4b18c8440e37a329aa5131381c220",
    "tests/seo/site.mjs": "6c219518b3277805f2a2a5edd79f5804bda1456a5b8f9adfef8533517ced2704",
    "tests/seo/access-fixture.py": "09b87f76fc534b18d5715067a7ce7519e04e3346c5e8686033fdab7bc755b64a",
    "tests/seo/capture-product.mjs": "2e9344dfe8fddecb761932f9063b92f870b331f967b50d4a484be6f3efb6d168",
    "tests/seo/examples.py": "54b0610b7ffe734198bbb720ce540e13d5736064275e0510c1b2b056aa02b1c5"
  }
}