Source
Architecture, reliability & security assurance — found from sitemap — Defguard
Checked for Defguard on 5 Nov 2026
- Page
- https://defguard.net/pentesting/
- Checked
- 5 Nov 2026, 14:23 UTC
- How we may use it
- Public page, crawling permitted
Technical details
- type
- page
- http status
- 200
- content hash
- sha256:205e5e7ee5f380f30a029b90f6f22777293535b05412f56d4ed9f6e7766bbbab
- permission
- robots_ok
- screenshot
- Screenshot on file (internal exhibit, not published)
Cited by
Facts read from this source
-
Open security transparency Report an error
“Defguard is fully open - not only with our code, but also with our development process, roadmaps, and detailed penetration testing reports from periodic security audits (done by ISEC) of all Defguard components.”
-
Vulnerability disclosure process Report an error
“Learn more how we approach security in Defguard and our Vulnerability Disclosure Process”
-
Public penetration reports Report an error
“Below you can find all previews and current reports, as well as links to GitHub Issues (linked to the corresponding Pull Requests) for each finding and its fix.”
-
Report date 2026 08 Report an error
“August 27, 2026 Get report”
-
Report tested versions Report an error
“Tested: Server: Core, Proxy, Gateway: 2.1.0-beta1, Desktop Client: 2.1.0-beta1, Mobile Client: 1.7.0-beta1”
-
Findings counts Report an error
“All (20) Critical (1) High (2) Medium (8) Low (7) Info (2)”
-
Finding dg2608 4 account takeover Report an error
“DG2608-4: [core] Full Account Takeover due to unescaped LIKE wildcards in find_by_email”
-
Finding dg2608 3 refresh token Report an error
“DG2608-3: [core] OAuth2 refresh_token grant skips client authentication and returns tokens unrotated”
-
Finding dg2608 9 signing key Report an error
“DG2608-9: [core] Instance master signing key exposed in support configuration bundle”
-
Finding dg2608 12 biometric key planting Report an error
“DG2608-12: [core] Broken Access Control in enrollment RegisterMobileAuth allows cross-user biometric key planting”
-
Finding dg2608 15 risk accepted Report an error
“DG2608-15: [core] Core pushes the deployment's external TLS private key and a deployment-wide cookie master key to every adopted edge”
-
Finding dg2608 17 setup dos Report an error
“DG2608-17: [core] Unauthenticated initial setup endpoints cause permanent DoS and persist rejected settings”
-
Finding dg2608 18 client ip Report an error
“DG2608-18: [proxy] Client IP address is taken from attacker-controlled forwarding headers and forwarded to Defguard Core”
-
Finding dg2608 20 edge adoption Report an error
“DG2608-20: [proxy, gateway] Unauthenticated Edge or Gateway adoption allows full core impersonation”
-
Components listed Report an error
“Tested: Server: Core, Proxy, Gateway: 2.1.0-beta1, Desktop Client: 2.1.0-beta1, Mobile Client: 1.7.0-beta1”
4 facts read from this page are not shown because they could not be confirmed on the page as captured.
Scores citing this record
- The DevOps Engineer Architecture, reliability & security assurance
- The IT Lead Architecture, reliability & security assurance
- The MSP Technician Architecture, reliability & security assurance
- The Operations Manager Architecture, reliability & security assurance
- The Information Security Officer Architecture, reliability & security assurance
- The Skeptic Architecture, reliability & security assurance