Continuous attack-surface testing with client-ready proof.
Customer vulnerabilities require replayable evidence. Dual-account IDOR/BOLA when you provide two test users. 12 first-party authenticated checks — not a 200-playbook catalog.
· Dual-account IDOR/BOLA when two test users (User A and User B) are provided.
· Confirmation gate: no customer vulnerability without replayable HTTP or OOB evidence.
· CVSS v3.1 on confirmed findings, with redacted replay PoCs.
· 12 first-party authenticated checks (BOLA when two test users are provided) + optional Nuclei/Prowler when those tools are installed. Nuclei/Prowler IDs are labeled separately and are not counted as Z2M playbooks.
· Owner's-risk Metasploit auxiliary/check is not Hard Proof unless replayable HTTP or OOB evidence exists.