DIAVERITAS — FICTIONAL SECURITY REPORT FORMAT
Original demonstration. No customer, target or measured result is represented.

Scope: fictional staging application at portal.example.invalid.
Authority: written permission from the fictional asset owner required before testing.
Test window, named contact, request ceiling and stop conditions: agreed before work.
Excluded: production, denial of service, social engineering and third-party assets.
Evidence: redact personal data, tokens and secrets; agree access and retention.

DEMO-SEC-01: Missing framing restriction on a fictional account page
Provisional severity: Low, pending validation of a sensitive framed action.
Illustrative observation: the sample response lacks CSP frame-ancestors and X-Frame-Options.
Evidence template: request time, route, relevant response headers and an authorised reproduction.
Impact: possible clickjacking if a meaningful authenticated action can be framed.
Missing headers alone do not demonstrate account takeover or a working exploit.
Remediation: set an appropriate CSP frame-ancestors policy; add a compatible X-Frame-Options policy where needed.
Retest: NOT RUN. Verify the final headers and browser framing behaviour in scope.

Coverage template: list routes, roles, techniques and checks actually performed.
Limitations: a point-in-time assessment cannot prove the absence of vulnerabilities.
This sample is not certification, client evidence or a comprehensive penetration test.
Reference: https://owasp.org/www-project-web-security-testing-guide/