# Scoped application security test plan

Completed example — all product names, people, evidence IDs and results below are synthetic teaching data. They are not test results from this website or an assessment of a real product.

## Authorization and scope

Product LedgerDesk r43/artifact D43 on an isolated staging host with north/south synthetic invoices. Authorized owner Mira; window 09:00–11:00 UTC on the exercise date. Maximum two concurrent clients and ten requests per second. No production identities, destructive storage operations or external callbacks. Stop on unexpected real data. Redact cookies and delete captures after 30 days.

Baseline: selected OWASP ASVS v5.0.0-8.2.2 and v5.0.0-8.4.1, plus WSTG v4.2 WSTG-ATHZ-04 as a testing method. These selected cases do not claim an ASVS level. Excluded: recovery, mobile client, payments.

## Test design and synthetic results

| Test | Invariant / setup | Procedure | Expected response and effect | Result / evidence |
| --- | --- | --- | --- | --- |
| T-01 | Owner north/u1→north/n1 | Read and export n1 | 200, only n1, one private export | Pass, run43/01 |
| T-02 | Same tenant, wrong owner | u2 requests n1 by direct ID and export | Deny, no row or export object | Pass, run43/02 |
| T-03 | Cross tenant | south/u3 requests n1 and its download ID | Deny, no north bytes | Pass, run43/03 |
| T-04 | Finance-admin north | Export n1,n2 | Both north rows, no south rows | Pass, run43/04 |
| T-05 | Revoked queued actor | Queue, revoke membership, run worker | No export bytes created | Fail, run43/05; defect F-118 |
| T-06 | Cache audience | u1 then u3 same format; reverse order | Each response scoped to requester | Pass, run43/06 |

## Exit decision

Block release on F-118: the worker checks permission only at enqueue. Owner Mira repairs execution-time membership enforcement and adds a regression. Rerun T-05 and the owner/finance-admin positive cases on the new immutable candidate. Keep response and final store-state evidence because a 403 response alone would not prove no export was produced.

Sources: [ASVS 5.0.0](https://github.com/OWASP/ASVS/tree/v5.0.0), [WSTG 4.2 object references](https://wstg.owasp.org/v4.2/4-Web_Application_Security_Testing/05-Authorization_Testing/04-Testing_for_Insecure_Direct_Object_References/).