01 · Identify
A documented starting point
An issue reproduced in the browser using the website’s code, with clear steps and an explanation of its impact.
Technical file · Code, configuration and verification
A fix should be verifiable.
Document the issue, explain the fix and provide what’s needed to verify it.
Internal case on inobic.fr · 7 November 2026 · Sources and results available
Internal audit: a real form issue fixed
HTML / JavaScript · Azure
If JavaScript fails, where does the message go?
Reviewing INOBIC’s code showed that submitting without JavaScript could put form text in the URL. The issue was reproduced locally, fixed and retested with synthetic data. The file explains the conditions, added protections and verifiable evidence.
Internal review of the INOBIC website. Source files and test results are available in this case study. This case covers a targeted review of code, Azure configuration and the contact flow. It is not presented as a client engagement or penetration test.
Read the findings, decisions and limitations →What makes the work verifiable
02 · Fix
A clearly explained fix
A JavaScript fix, an alternative contact option when scripts are unavailable, and a CSP rule that blocks native form submissions. The code diff is available.
03 · Verify
Results you can inspect
Before-and-after tests cover disabled JavaScript, copying the summary and the manual fallback. The issue was reproduced locally with synthetic data.
Technical evidence
Educational supplement: .NET access control
An isolated example illustrates a fix for access control by organisation and owner. The same ten tests run before and after the fix. It supplements the internal case; it does not establish client engagement experience with .NET or Azure.
View the lab and its results
Console demonstration using simulated identities and synthetic data, with no live server or database.
For your project, start with your code and risks
We agree on the components to review, the access needed, permitted methods and expected deliverables. The review should produce findings specific to your application and fixes your team can verify.
Discuss your audit scopeThese documents are self-produced. No independent audit, client reference or accreditation is claimed.
Evidence-backed audit practices
Written authorisation, risk-based checks, collection of only the evidence needed, and verification of fixes. Our method also records checks that were not performed and risks that remain unresolved.
Explore our audit method and checklists →