{
  "format": "wshawk-authorization-benchmark",
  "version": 1,
  "generated_at": "2026-07-23T07:48:29.905Z",
  "wshawk_version": "4.0.4",
  "target": {
    "type": "owned-loopback-lab",
    "origin": "http://127.0.0.1:57225",
    "websocket_origin": "ws://127.0.0.1:57225/ws/echo"
  },
  "summary": {
    "scenario_count": 34,
    "passed": 34,
    "failed": 0,
    "true_positives": 17,
    "true_negatives": 17,
    "false_positives": 0,
    "false_negatives": 0,
    "precision": 1,
    "recall": 1,
    "mean_latency_ms": 56,
    "p95_latency_ms": 122,
    "request_count": 326,
    "finding_count": 21,
    "worker_heap_before_bytes": 2703360,
    "worker_heap_after_bytes": 16687104,
    "worker_heap_delta_bytes": 13983744,
    "encrypted_database": true,
    "finding_management_passed": true
  },
  "finding_management": {
    "duplicate_same_id": true,
    "duplicate_marked": true,
    "edited": true,
    "retest_classification": "still_vulnerable",
    "retest_classifications": {
      "fixed": "fixed",
      "authentication_expired": "authentication_expired",
      "endpoint_changed": "endpoint_changed",
      "inconclusive": "inconclusive"
    },
    "selected_exports": {
      "json": {
        "count": 3,
        "nonempty": true
      },
      "markdown": {
        "count": 3,
        "nonempty": true
      },
      "csv": {
        "count": 3,
        "nonempty": true
      }
    }
  },
  "scenarios": [
    {
      "transport": "HTTP",
      "name": "Horizontal IDOR/BOLA secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 42,
      "request_count": 8,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Horizontal IDOR/BOLA vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_idor",
      "duration_ms": 40,
      "request_count": 8,
      "confirmation_count": 2,
      "finding_id": "finding_77198014e763c9c3c14c2661da2b7189",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "UUID object authorization secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 34,
      "request_count": 8,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "UUID object authorization vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_idor",
      "duration_ms": 39,
      "request_count": 8,
      "confirmation_count": 2,
      "finding_id": "finding_771606db51d0617bba0fbd21cebb2d3b",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Numeric neighboring object authorization secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 35,
      "request_count": 8,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Numeric neighboring object authorization vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_idor",
      "duration_ms": 59,
      "request_count": 8,
      "confirmation_count": 2,
      "finding_id": "finding_55354112bfda366fbf06195b3ccf2452",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Nested account/order authorization secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 33,
      "request_count": 8,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Nested account/order authorization vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_idor",
      "duration_ms": 43,
      "request_count": 8,
      "confirmation_count": 2,
      "finding_id": "finding_26d55b6783e3beb5f50e4cb82b522df1",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Tenant isolation secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 36,
      "request_count": 8,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Tenant isolation vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_tenant_isolation_bypass",
      "duration_ms": 63,
      "request_count": 8,
      "confirmation_count": 2,
      "finding_id": "finding_15ad15ee21fb912d73019a8137cec7d8",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Missing authentication secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 44,
      "request_count": 8,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Missing authentication vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "missing_authentication",
      "duration_ms": 68,
      "request_count": 8,
      "confirmation_count": 2,
      "finding_id": "finding_d892f4baf7920dd3220dfdb62516c902",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Query-parameter IDOR secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 44,
      "request_count": 8,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Query-parameter IDOR vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_idor",
      "duration_ms": 51,
      "request_count": 8,
      "confirmation_count": 2,
      "finding_id": "finding_150e9b56675827cd499444385c36dd0a",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "JSON-body IDOR secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 48,
      "request_count": 8,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "JSON-body IDOR vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_idor",
      "duration_ms": 63,
      "request_count": 8,
      "confirmation_count": 2,
      "finding_id": "finding_1d29a7ae3fb9015cd8c3302ef50414b6",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Vertical privilege escalation secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 31,
      "request_count": 4,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Vertical privilege escalation vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_privilege_escalation",
      "duration_ms": 47,
      "request_count": 4,
      "confirmation_count": 1,
      "finding_id": "finding_c97a4963b0f5ae21e6003a3dbce5f8a4",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Admin-only secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 28,
      "request_count": 4,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Admin-only vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_admin_operation_bypass",
      "duration_ms": 50,
      "request_count": 4,
      "confirmation_count": 1,
      "finding_id": "finding_9565a934ffd7ead309fa8d53171a93b8",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "BFLA secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 23,
      "request_count": 4,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "BFLA vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_bfla",
      "duration_ms": 46,
      "request_count": 4,
      "confirmation_count": 1,
      "finding_id": "finding_e04027c63c6c4911676b16a29cd964b2",
      "rollback_verified": true
    },
    {
      "transport": "GraphQL",
      "name": "GraphQL secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 39,
      "request_count": 8,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "GraphQL",
      "name": "GraphQL vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_idor",
      "duration_ms": 68,
      "request_count": 8,
      "confirmation_count": 2,
      "finding_id": "finding_1e10a3fb318681379f703b7587f92047",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "State-changing IDOR secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 108,
      "request_count": 30,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "State-changing IDOR vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_idor",
      "duration_ms": 138,
      "request_count": 30,
      "confirmation_count": 2,
      "finding_id": "finding_35a02a1ad0b35f2bff7ba086196e3920",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Ownership transfer secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 89,
      "request_count": 30,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Ownership transfer vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_ownership_transfer_bypass",
      "duration_ms": 122,
      "request_count": 30,
      "confirmation_count": 2,
      "finding_id": "finding_ce549224288e9da28ab044751bec9a7d",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Mass assignment secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 16,
      "request_count": 3,
      "confirmation_count": 0,
      "finding_id": "",
      "rollback_verified": true
    },
    {
      "transport": "HTTP",
      "name": "Mass assignment vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_bfla",
      "duration_ms": 26,
      "request_count": 3,
      "confirmation_count": 1,
      "finding_id": "finding_a1ad0d0eda6c9cdc37410cfab6e31ceb",
      "rollback_verified": true
    },
    {
      "transport": "WebSocket",
      "name": "WebSocket room secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 74,
      "request_count": 8,
      "confirmation_count": 0,
      "finding_id": ""
    },
    {
      "transport": "WebSocket",
      "name": "WebSocket room vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_idor_bola",
      "duration_ms": 91,
      "request_count": 8,
      "confirmation_count": 2,
      "finding_id": "finding_b0f35bae79e753328612d8073f28a489"
    },
    {
      "transport": "WebSocket",
      "name": "WebSocket subscription secure control",
      "expected_vulnerable": false,
      "observed_finding": false,
      "passed": true,
      "verdict": "access_control_enforced",
      "duration_ms": 83,
      "request_count": 8,
      "confirmation_count": 0,
      "finding_id": ""
    },
    {
      "transport": "WebSocket",
      "name": "WebSocket subscription vulnerable",
      "expected_vulnerable": true,
      "observed_finding": true,
      "passed": true,
      "verdict": "potential_idor_bola",
      "duration_ms": 95,
      "request_count": 8,
      "confirmation_count": 2,
      "finding_id": "finding_1ecb35ce62fba18102375dfb240b5a74"
    }
  ]
}