Safety first at Incontrol

The results

During the penetration test, no critical or high-severity findings were identified. The testers were unable to obtain sensitive data or take over the server via the application. This is a very positive outcome that we are proud of.

Medium-severity vulnerabilities

The penetration test resulted in a few medium-severity vulnerabilities (a total of 3). The most relevant findings involved input validation-related vulnerabilities. These included triggering an SSRF payload and the possibility of HTML injection in some input fields. Another finding was the presence of JavaScript sourcemaps.

While these three vulnerabilities are not considered critical, they still pose a risk to the application's security and integrity. It was essential to address these issues to prevent potential exploitation by attackers. In our latest release, these three vulnerabilities have been promptly resolved.

Low-severity vulnerabilities

All other findings were of low severity (7 in total). There is no immediate need to resolve these low-severity findings, but implementing solutions for them will further enhance Incontrol's security. We aim to establish a baseline that instills even greater confidence, so we are planning to address and mitigate these low-severity findings as well.

We are confident in the security of our platform and remain committed to continuously improving our security measures.

For more information on how we protect your data and our information security measures, please visit our information security page.