Trust asset

Sample public finding report.

This page shows the structure Proof uses for a Continuous Correctness Audit finding. It is intentionally public-safe: no customer identifiers, no private code, and no proprietary delivery details.

Report metadataSample only
Project

Public demonstration: GraphQL router validation path

Cadence

Launch review, then per-release retest

Evidence

Request fixture, failing regression test, severity rationale, patch retest

Executive summary

Proof reviewed a GraphQL router validation path for drift against expected behavior.

This public demonstration shows the level of specificity a buyer should expect: affected surface, reproducer, impact, severity reasoning, remediation, and retest status. Customer reports use the same evidence standard with customer-specific details kept private.

Findings reviewed: 11 candidate behaviors Confirmed findings: 1 high, 2 medium Highest severity: High Affected surface: persisted-query validation and variable coercion Evidence quality: request fixture, failing regression test, patch retest Remediation status: verified fixed in demonstration patch branch

Finding structure

Every finding should be reviewable without trusting a black box.

01

Finding title and status

Severity, confidence, affected versions, discovery mode, status, and affected surface.

02

Summary and business impact

Plain-language behavior mismatch and why the buyer should care.

03

Expected vs observed behavior

The intended behavior and the actual behavior, written in public-safe terms.

04

Reproducer

Minimal steps or test case showing the behavior deterministically.

05

Evidence and retest

Regression artifacts, coverage, MC/DC or formal evidence, remediation guidance, and patch verification.

Sample body

CCA-2026-014: persisted query bypasses variable validation after cache hit.

A cached persisted query is executed with a new variables payload whose shape would be rejected on the uncached path. The router applies validation on the initial registration request, but the replay path trusts the cached plan too broadly.

AssessmentPublic safe
Severity

High

Confidence

Confirmed

Status

Verified fixed in demonstration patch branch

Impact

Validation bypass, inconsistent behavior across equivalent request paths, potential downstream resolver load amplification.

Expected behavior: The persisted-query replay path must apply the same variable-shape validation as the uncached execution path before the query reaches planning or resolver execution. Observed behavior: The uncached path rejects {"limit": {"nested": 100000}}, but replaying the same operation through the persisted-query cache accepts the payload and starts execution. Minimal reproduction: 1. Start from demonstration commit: router-demo@9f42c21. 2. Register persisted query Q1 with valid variables: {"limit": 10}. 3. Replay Q1 with variables: {"limit": {"nested": 100000}}. 4. Observe 200 response and resolver invocation on the cached path. 5. Run the uncached equivalent request and observe the expected validation error.
ArtifactSample value
Reproducer commandnpm test -- router.persisted-query.validation.spec.ts
Failing assertionCached and uncached request paths must return the same validation decision for equivalent operation + variables.
Patch checkValidation moved before cached-plan execution; regression test passes on patched branch.
Residual riskAdjacent replay paths for subscriptions and deferred responses should be reviewed before broad release.

Severity rationale

How the finding is triaged.

DimensionAssessment
ExploitabilityRequires ability to send persisted-query replay requests; no privileged server access required in the demonstration deployment.
PreconditionsPersisted-query cache enabled, cached plan reused before variable-shape validation, resolver path reachable.
Blast radiusAffects every service behind the router that trusts router-level variable validation.
Security boundaryPotential policy or validation boundary bypass depending on resolver assumptions.
DoS potentialMalformed nested inputs can reach resolver code and amplify CPU or downstream calls.
ConfidenceConfirmed by deterministic reproducer and patched-path retest.

Remediation

Guidance should retire the class, not just patch the instance.

  • Fix the immediate branch or state transition.
  • Add the reproducer as a regression test.
  • Add adjacent edge-case tests.
  • Confirm behavior against the requirement or invariant.
  • Re-run the Continuous Correctness Audit corpus.

Disclosure

Public-safe by default.

  • No client-specific identifiers.
  • No private source code.
  • No proprietary Proof orchestration details.
  • No proprietary engine details.
  • MC/DC, formal verification, reproducers, and evidence concepts may be discussed.