SEAL OF SIGMUNDSECURITY DESKSample desk →
Receipt sample_receipt_currentSchema scan_receipt_v3Fingerprint 46d15a8da610…567ba126

01IDENTITY

SYNTHETIC SAMPLE · NO REPOSITORY CONNECTED · NO SCAN OR PRODUCT DATA

SYNTHETIC SAMPLE RECEIPT · ALPHA SCANNER · LIMITED CAPABILITY

Illustrative passive assessment

sample_receipt_current

Repository
Example-Customer/sample-next-app
Synthetic binding only; not acquired
Code version
0123456789ab…01234567
Synthetic commit identity
Scanned
Status: incomplete
Application root
.
Illustrative configured scope
Source scanner
seal-passive-web-scanner 0.13.0
Illustrative current profile
Dependency scanner
OSV Scanner 2.5.1
Illustrative pinned version

02VERDICT

8

findings rated

LOW OR ABOVE — highest: HIGH

Limited coverage · 7 of 9 domains available · 4 informational observations. A match is evidence to review, not proof that a weakness is exploitable.

03FINDINGS

Filter and inspect scanner observations without losing the receipt’s overall context.

12 TOTAL OBSERVATIONS
Observations
12
Signals emitted by current checks
Affected assets
5
Unique paths or package scopes
Categories represented
1
Domains containing observations
Showing 12 of 12 findings
HIGH5
components/code-preview.tsx:8:3JS-EVAL-001

A Next.js Client Component search parameter reaches direct eval interpretation through a completely resolved supported path.

Source code
components/code-preview.tsx:9:3JS-FUNCTION-CONSTRUCTOR-001

A Next.js Client Component search parameter reaches Function constructor interpretation through a completely resolved supported path.

Source code
components/code-preview.tsx:11:3JS-SET-INTERVAL-STRING-001

A Next.js Client Component search parameter reaches string-valued setInterval interpretation through a completely resolved supported path.

Source code
components/code-preview.tsx:10:3JS-SET-TIMEOUT-STRING-001

A Next.js Client Component search parameter reaches string-valued setTimeout interpretation through a completely resolved supported path.

Source code
app/api/proxy/route.ts:5:3NEXT-ROUTE-OUTBOUND-REQUEST-001

A Next.js Route Handler query parameter reaches a server outbound-request interpreter through a completely resolved supported path and requires review.

Source code
MEDIUM3
app/server/page.tsx:5:3NEXT-SERVER-REDIRECT-001

A Next.js App Router page search parameter reaches a server redirect interpreter through a completely resolved supported path and requires review.

Source code
components/continue-button.tsx:9:3NEXT-CLIENT-NAVIGATION-001

A Next.js Client Component search parameter reaches a client navigation interpreter through a completely resolved supported path and requires review.

Source code
app/api/redirect/route.ts:5:3NEXT-ROUTE-REDIRECT-001

A Next.js Route Handler query parameter reaches a redirect interpreter through a completely resolved supported path and requires review.

Source code
INFO4
components/code-preview.tsx:8:3JS-ACTIVE-CONTENT-001

An active-content sink is present; this scan did not establish an untrusted source reaching it.

Source code
components/code-preview.tsx:9:3JS-ACTIVE-CONTENT-001

An active-content sink is present; this scan did not establish an untrusted source reaching it.

Source code
components/code-preview.tsx:10:3JS-ACTIVE-CONTENT-001

An active-content sink is present; this scan did not establish an untrusted source reaching it.

Source code
components/code-preview.tsx:11:3JS-ACTIVE-CONTENT-001

An active-content sink is present; this scan did not establish an untrusted source reaching it.

Source code

04DOMAIN COVERAGE

Coverage status is separate from finding severity. Green means a domain was checked and nothing was observed.

7 AVAILABLE · 0 UNSUPPORTED · 2 PLANNED

Source code

12 observations

Passive code patterns and source-level evidence.

Dependencies

None observed

Offline advisory matches from admitted package manifests and lockfiles.

Configuration

None observed

Security headers, framework settings, and unsafe defaults.

Authentication

None observed

Identity, session, credential, and sign-in controls.

Authorization

None observed

Permission checks, tenant boundaries, and access control.

Secrets

None observed

Exposed credentials, tokens, keys, and sensitive material.

Infrastructure

None observed

Cloud, container, deployment, and infrastructure-as-code posture.

Runtime

Capability planned

Execution-path and live application behavior evidence.

Dynamic testing

Capability planned

Externally exercised application behavior and attack-surface evidence.

05APPLICATION MAP

Passive source inventory used to select applicable security recipes. Presence is architectural evidence, not a weakness finding.

PARTIAL
Routes
4
Boundaries
6
Integrations
0
Environment names
0
Origins
1
Router: appParsed: 6/6 filesUnresolved inventory items: 1 (1 dynamic origin expression)
View discovered routes4
  • / · page · GET
  • /server · page · GET
  • /api/redirect · route handler · GET
  • /api/proxy · route handler · GET
View server and client boundaries6
  • app/page.tsx · server component
  • app/server/page.tsx · server component
  • app/api/redirect/route.ts · route handler
  • app/api/proxy/route.ts · route handler
  • components/continue-button.tsx · client module
  • components/code-preview.tsx · client module
View identity and data integrations0

No integration from the pinned catalog was observed.

View environment names0

No statically named environment access was observed.

View literal external origins1
  • https://example.invalid

Partial coverage · dynamic origin expression observed.

06COVERAGE & CUSTODY

Source coverage
8 considered / 12 in scope / 4 excluded
Recipe coverage
39 complete / 9 limited
Dependency closure
3 in scope / 0 excluded
Execution
No repository exists or was executed
Isolation
deny-all · no repository acquired
Retention
Not applicable · immutable synthetic data

07LIMITS

This sample illustrates how a bounded receipt communicates missing coverage. Its findings and counts are not customer results.

  1. This is illustrative synthetic data, not the output of a repository scan.
  2. One dynamic origin expression was not resolved.
  3. Two entrypoints require interprocedural or manual authorization review.
View 3 additional methodology and coverage limits
  1. Absence is limited to exact provider credential and API-key formats in supported text files.
  2. Runtime reachability and exploitability were not established.
  3. Repository code was not executed and deployed behavior was not tested.