Étage 2+ · authenticated · staging only · mandate-gated

Scan behind the login.

Tests the member area: IDOR / broken access control, session-cookie security, and reflected injection. GET-only and destructive-keyword URLs are excluded so nothing gets deleted. Runs only against a non-production environment with a dummy account, under a valid mandate.

Member-area base URL (staging)

Session cookie (from the client's browser — sidesteps MFA)Extra headers (JSON, optional — e.g. Bearer token)IDOR targets — one URL template per line, {id} or a trailing numberInjection test paths — one URL per line (defaults to base URL)

EnvironmentI confirm this is a non-production environment with a dummy account (no real PII).

Authorization — verify domain ownership to unlock the scan

1Prove you own the domain
2Accept the mandate & verify
I am authorized to order this test and I accept the audit mandate & terms. I confirm I will use a non-production, dummy-data account, and I am responsible for the accuracy of the information provided.
3Scan unlocked
Complete steps 1–2 to unlock the scan.