Skip to content

Penetration Test 2026 — Findings, Remediation & Risk Acceptance

Purpose. The remediation tracker and the formal risk acceptance that the penetration test report's own conclusion asks for: "A remediation plan … should be developed and agreed … Formal risk acceptance should occur for exposures that cannot be mitigated or are accepted by the business." The report itself is confidential and is held in the evidence store, not in this repository.

1. The test
Tester Agency Cyber Inc. ("Agency Comply"): primary and secondary penetration testers, senior reviewer. Independent of Soon
Type Web application penetration test, authenticated (greybox), against production
Scope app.soon.works; soon-server-alb-production.soon.works (API). Excluded: denial of service, social engineering, advanced persistence
Test accounts Two isolated test tenants, one account per role, holding synthetic data only (S-497)
Window Tested 21–22 September 2026 (agreed window 21–23 September)
Report v1.0 final, 24 September 2026
Overall result Low risk. 0 critical · 0 high · 0 medium · 1 low · 3 informational

2. Findings and treatment

# Finding Severity Treatment Status (16 Oct 2026) Tracked
1 Weak cipher suites (TLS 1.2 CBC with RSA key exchange) supported on app.soon.works Low (CVSS 4.0: 2.3) Remediation attempted, then accept (§3). The zone's cipher suites were set to Modern (ECDHE + AEAD) on 16 Oct 2026. The re-test shows this applies to proxied hostnames such as www.soon.works but not to app.soon.works, which is a Cloudflare Pages custom domain. Cloudflare does not allow cipher suites to be configured for Pages hostnames Accepted (platform limitation) S-607
2 Application allows concurrent logins Informational Accept (§3) Accepted S-609
3 Lack of input validation: HTML accepted in the board name and returned unencoded in the GraphQL response Informational Remediate, in a different way from the report's recommendation. Not by restricting character sets, which would reject legitimate names (Équipe Nord, O'Brien, Sales & Support). In the browser, React escaping plus an enforced CSP with script-src 'self' and no unsafe-inline already prevent execution. The work is output encoding wherever names leave the browser: notification emails, calendar events, Slack/Teams messages, PDF and CSV exports. That is the lesson of incident INC-2025-01 (POST25), where names carried phishing text into invitation emails Open; review in progress S-610, S-500
4 Single-factor authentication for email/password accounts Informational Accept for now, with a roadmap (§3) Accepted S-609, S-377

Related items raised by Soon's own review of the report (not findings of the tester):

Item Treatment Tracked
/auth/sign-in/discover reveals whether an account exists and whether it is password-only (account enumeration). It makes finding #4 more exploitable Remediate: uniform responses for unknown and password accounts; route SSO by email domain S-608
The API hostname resolves directly to AWS rather than through Cloudflare, so Cloudflare's WAF does not cover the API Remediate: proxy through Cloudflare or attach AWS WAF; confirm current WAF state S-426
Tester IP allowlist and the six test accounts remain after testing ended Remove the allowlist entries; deactivate the accounts and tenants S-606
The report does not state whether tenant isolation and role escalation were tested Ask the tester for a coverage statement S-611

The test is a point-in-time assessment. No re-test is included in the engagement. Each remediation is closed in Linear with its evidence (configuration change, re-test output or pull request), which is accepted practice for SOC 2 and ISO/IEC 27001 in place of a paid re-test.

3. Formal risk acceptance

Finding #1: weak TLS 1.2 cipher suites on app.soon.works. Accepted. The web application is served by Cloudflare Pages, and Cloudflare documents that cipher suites and minimum TLS version cannot be customised for Pages hostnames. The zone setting (Modern) was applied and re-tested on 16 Oct 2026. It covers www.soon.works but not the Pages hostnames app.soon.works, soon.works and isms.soon.works (re-test output: evidence row 52). Why the risk is low: the Pages hostnames serve only static files: the application's code, with no customer data and no sessions. Customer data and authentication travel to the API (soon-server-alb-production.soon.works), whose load balancer already refuses these suites. Every modern browser negotiates TLS 1.3 or ECDHE + AEAD with Cloudflare, so the weak suites are used only by a client that asks for them. Exploiting them needs an attacker in the network path and a client that downgrades. Revisit when: Cloudflare supports cipher control for Pages, or the web application moves to a hosting option that allows it (for example Workers static assets behind the zone's settings). Residual risk: Low.

Finding #2: concurrent logins. Accepted. Concurrent sessions are how Soon is used: planners work on desktop while agents use phones, at the same time. Ending the previous session on every login would break normal use. Compensating controls: __Host- session cookie (HttpOnly, Secure, SameSite=Lax); sessions are revocable server-side. Roadmap: an active-sessions view with "sign out everywhere" (S-376). Residual risk: Low.

Finding #4: single-factor password login. Accepted until native MFA ships. This is a known limitation, disclosed to customers and recorded as product risk R-22 in the Access Control Policy §2.5. Compensating controls: enterprise SSO and Google/Microsoft login, which inherit the identity provider's MFA; password attempts throttled per IP (60 per minute) and per account; sessions record their authentication method, so step-up can be added without rebuilding login. Precondition: account enumeration (S-608) is fixed first, because it is what turns

4 into a targeted attack. Roadmap: optional TOTP or passkey, enforceable per organisation

(S-377). Residual risk: Medium, reducing to Low once S-608 closes.

All three acceptances are reviewed at the next management review and whenever a related change ships.

Accepted by: the Information Security Manager, on behalf of top management, by approval of this document. The approval date is the acceptance date.

Change log

Version Date Author Change
0.1 2026-10-13 ISMS First version: findings of the 24 September 2026 report, treatments, Linear tracking and the formal acceptance of findings #2 and #4. For checklist row 52 (CC7.1).
0.2 2026-10-16 ISMS Finding #1 moved from remediate to accept. The Cloudflare Modern cipher setting was applied and re-tested; it does not reach Cloudflare Pages hostnames such as app.soon.works (platform limitation). Re-test filed on row 52.