FrontierCyber Defence

Our own target

We attack a site we own, in public, and publish the holes we miss.

Updated 16 August 2026

Most of the proof on this site is borrowed from other people's research. This is ours. We stood up a target we own, planted a known set of holes in it, and scan it on a schedule with the same pipeline a customer gets. The scorecard below shows what the scan found and, at the top, the holes we planted and did not find.

The proving ground scorecard

2 holes we planted and did not find
11 holes planted in the target
9 found by the scan
82% found on this run

Our scan of proving.synchronality.com, run 16 August 2026. Every finding on this run maps to a hole we planted.

The holes we missed

These are planted in the target and the scan did not find them. They are here first because a scorecard that hides its misses is worth nothing.

  • cross-site scripting /guestbook

    Stored comments render unescaped, so a stored comment can carry a script. This is planted to be MISSED: the wired probe set only tests reflected input and never submits the stored payload.

  • access control /api/profile?id=

    Any user's record is returned by id with no authentication, an insecure direct object reference. This is planted to be MISSED: it is not on the scanner's fixed API path list, and a cold external scan has no second account to prove the authorization gap with.

How this is scored

  1. This target is a server we own and control. Its source is app/proving-target/server.js, and every hole in it is planted on purpose.
  2. We scan it with the same probe code a customer scan runs. The passive and active checks are the ones in app/src/scan, with no special case for our own site.
  3. The answer key is committed at app/proving-target/inventory.json. It lists every planted hole, its category, its location, and how it was planted.
  4. The scoring compares the scan's findings to that answer key. A planted hole with a matching finding is found. A planted hole with no matching finding is a miss, and the miss count is at the top of this page.
  5. The proving ground runs on its own hourly budget and its own schedule. It shares no budget and no data path with any customer scan.
Every hole planted in the target, with where it is and whether the scan found it
IDCategoryLocationSeverityResult
PG-001 security headers response headers on every page Low Found
PG-002 cookie flags Set-Cookie on / Low Found
PG-003 published versions Server and X-Powered-By response headers Low Found
PG-004 cross-site scripting /search?q= High Found
PG-005 open redirect /?url= Medium Found
PG-006 sensitive file exposure /.git/config High Found
PG-007 sensitive file exposure /backup.sql High Found
PG-008 sensitive file exposure /administrator/ Medium Found
PG-011 cross-site request forgery /guestbook Medium Found
PG-009 cross-site scripting /guestbook High Missed
PG-010 access control /api/profile?id= High Missed

The target is deliberately vulnerable and holds no real data. Its source, and the answer key it is scored against, are in the repository at app/proving-target/. A sceptical engineer can read both and reproduce every number here.