Penetration test 2026

Owner: Mira Holm · Follow-up: Marek Nowak (identity-service), Aiko Tanaka (portal)

Our yearly test by an outside firm, the same firm as 2025.

Scope

• The portal and the identity-service API, in a staging copy of the EU region.
• Every way to sign in: password, phone code, single sign-on (Entra ID and Okta test tenants), MFA for administrators.
• Access requests and approvals, including depot approvers.
• Not in scope: AWS itself, the notifier's providers, our office.

Dates

Test window	5 October to 9 October. Testers' addresses allowed through the edge limits (OPS-46).
First read-out	9 October: no critical findings
Report	Received 23 October

Findings

#	Severity	Finding	Owner	Due
M1	Medium	The sign-in page sends a person to their company's sign-in when their email's domain uses single sign-on, which tells a stranger that the domain is a customer	Marek	20 Nov
M2	Medium	Invitations to new administrators can be re-sent without a limit	Marek	20 Nov
M3	Medium	Changing a password doesn't end the person's other sessions	Marek	20 Nov
L1	Low	The portal's content security policy is in report-only mode	Aiko	next quarter
L2	Low	A failed metadata upload shows the parser's error message	Marek	next quarter
L3	Low	The status page accepts old TLS ciphers	Oskar	next quarter
L4	Low	A cookie without the SameSite attribute on the portal's language switch	Aiko	next quarter

No critical or high findings. Nothing suggests anyone used any of these.

For customers

Halden asked on the call on 13 October (question 22): Marek answered that the test had run and the report would follow on 23 October. Customers can have the summary under NDA; ask Mira.