§Trust Page

RevokedDemo record
V2Application Verified

Example Connect API

Owner: Example Labs · api.example.net

Partner integration API.

Certificate IDV2-2025-0197
Verified on
Valid until
MethodologyV-Standard 2025.4
EnvironmentProduction
MonitoringNot included
StatusRevoked ·
Domains in scopeapi.example.net
5 / 6
5 of 6 checks passed
Critical 0High 1
A certificate is not a promise of absolute security. It confirms the results of the checks only within the published scope, on the stated date and under the stated version of the methodology.

Not covered by this certificate

  • Partner-side integrations

Scope of the certificate

Components in scope
API, Domains and DNS
Domains in scope
api.example.net
Environment
Production
Methodology
V-Standard 2025.4
Level
V2 · Application Verified

Verified checks

Each row names the check, its method, the date and a public evidence summary. Technical details are held privately by CyberSecurityV.

A · External perimeter
A01 TLS configuration and certificate validityPublic endpoints negotiate only modern protocol versions with a valid, correctly chained certificate. Automated check Passed
Public evidence summaryPublic endpoints negotiate only modern protocol versions with a valid, correctly chained certificate.
CheckSupported protocol versions and cipher suites, certificate chain, expiry, revocation information, key strength and known TLS weaknesses on every public endpoint in scope.
A03 DNS configuration and zone hygieneNo dangling records or takeover conditions were found in the domains in scope. Automated check Passed
Public evidence summaryNo dangling records or takeover conditions were found in the domains in scope.
CheckAuthoritative servers, DNSSEC where applicable, dangling records that allow sub-domain takeover, zone transfer exposure and consistency between public and expected records.
B · Application and API
B05 Input handling and injectionServer-side input handling resisted the injection classes in scope. Automated and manual check Passed
Public evidence summaryServer-side input handling resisted the injection classes in scope.
CheckServer-side injection classes — SQL, NoSQL, command, template, path traversal, server-side request forgery, XML external entities — across the endpoints in scope.
B07 API authentication and object-level authorisationAPI resources enforce authentication and object-level authorisation. Automated and manual check Failed
Public evidence summaryAPI resources enforce authentication and object-level authorisation.
CheckToken handling, key rotation, object- and property-level authorisation on API resources, function-level access control.
NoteObject-level authorisation regression detected during a scheduled re-check; not remediated by the deadline.
B08 API inventory and exposureThe API surface matches the documented inventory. Automated check Passed
Public evidence summaryThe API surface matches the documented inventory.
CheckUndocumented or deprecated endpoints, debug and internal APIs reachable from outside, excessive data exposure in responses.
B09 Rate limiting and abuse controlsResource-intensive operations are rate-limited. Automated check Passed
Public evidence summaryResource-intensive operations are rate-limited.
CheckLimits on authentication, messaging, export and other resource-intensive operations; protection against automated abuse.

Verification history

  1. Application submitted
  2. Certificate issued
  3. High-severity risk detected
  4. Certificate revoked

Verify this record

The registry record behind this page is signed with the CyberSecurityV registry key. Your browser can verify the signature and the fingerprint without contacting anyone but the registry.

Record fingerprint (SHA-256): ba9947d944033829eb0cfb69fd8c5a2224decabe90f1b17791a7d80fb6e71ba3
Registry signature (Ed25519): Iivs36Ywv/GWOMi/mzlC3n6nsN3ddxCZe6UA9/IvXeR6I/z9roygI4ed5K8uCQ9rBaoEIO1d3+NS7xEozJMODw==
Registry public key: ed25519-d050be27b99b · V2-2025-0197.json