Self-tested.
Our own team ran these tests. They were not carried out or verified by an independent third party.
Summary
| Test date | 6 November 2026 |
|---|---|
| Tool | Strix 1.7, open-source AI penetration testing |
| Target | A self-hosted test copy with fake data, and its source code |
| Accounts used | Four roles across two workspaces |
| High-severity issues found | 1 |
| Open high-severity issues after retest | 0 in the areas retested |
Issue found and fixed
| Severity | Issue | Fix | Retest |
|---|---|---|---|
| High | Two-step sign-in could be turned off with only a password | Turning it off is now refused, along with related routes that relied on a password alone. Replacing a lost device needs a password and an unused backup code. | Passed in a live test |
Areas tested
| Area | How | Result |
|---|---|---|
| Access to another workspace | Live test | No issue found |
| Actions above a person's role | Live test | No issue found |
| Reaching private addresses (SSRF) | Live test | No issue found |
| Reading stored secrets | Live test and code review | No issue found |
| SQL injection | Code review | No issue found |
| Cross-site scripting | Live test | No issue found |
| Webhook signature bypass and replay | Live test | No issue found |
| Template injection in workflows | Live test and code review | No issue found |
| Two-step sign-in | Live test | 1 high issue, fixed |
| Concurrent approvals | Code review in the retest | No issue found. Not load tested |
Limits of this report
- This is a self-run, point-in-time test, not a certification.
- The test ended when its spending limit was reached, so coverage was not exhaustive.
- The retest was focused, and part of it was confirmed by reading the code. Strix also marked business logic and race conditions as not fully covered.
- Hosted mode and Stripe billing were not part of the live test.
- Features added after 6 November 2026 are not covered until the next test.
- Prompt injection remains an industry-wide risk. See the security overview.
An independent third-party penetration test is planned. To report a vulnerability, email sales@shichifukutekx.ae.