§Trust Page
SuspendedDemo record
V2Application Verified
Example Portal
Owner: Example Labs · portal.example.net
Customer self-service portal.
Suspended · Status since
The certificate is temporarily not valid — usually after a material change of the product or a new risk that is being re-verified. It returns to Active after a successful re-check or becomes Revoked.
Reason: Material change of the product: the authentication provider was replaced after issue. Re-verification of the affected checks is in progress.
The certificate is temporarily not valid — usually after a material change of the product or a new risk that is being re-verified. It returns to Active after a successful re-check or becomes Revoked.
Reason: Material change of the product: the authentication provider was replaced after issue. Re-verification of the affected checks is in progress.
7 / 9
7 of 9 checks passed
Critical 0High 0
A certificate is not a promise of absolute security. It confirms the results of the checks only within the published scope, on the stated date and under the stated version of the methodology.
Not covered by this certificate
- Source code, dependencies and infrastructure
Scope of the certificate
- Components in scope
- Web application, Domains and DNS
- Domains in scope
- portal.example.net
- Environment
- Production
- Methodology
- V-Standard 2026.3
- Level
- V2 · Application Verified
Verified checks
Each row names the check, its method, the date and a public evidence summary. Technical details are held privately by CyberSecurityV.
A · External perimeter
A01 TLS configuration and certificate validityPublic endpoints negotiate only modern protocol versions with a valid, correctly chained certificate. Automated check Passed
Public evidence summaryPublic endpoints negotiate only modern protocol versions with a valid, correctly chained certificate.
CheckSupported protocol versions and cipher suites, certificate chain, expiry, revocation information, key strength and known TLS weaknesses on every public endpoint in scope.
A02 HTTPS enforcement and HSTSAll traffic in scope is forced to HTTPS and protected by HSTS. Automated check Passed
Public evidence summaryAll traffic in scope is forced to HTTPS and protected by HSTS.
CheckPlain-HTTP requests are redirected to HTTPS, HSTS is present with an adequate lifetime, and no content in scope is served over an unencrypted channel.
A03 DNS configuration and zone hygieneNo dangling records or takeover conditions were found in the domains in scope. Automated check Passed
Public evidence summaryNo dangling records or takeover conditions were found in the domains in scope.
CheckAuthoritative servers, DNSSEC where applicable, dangling records that allow sub-domain takeover, zone transfer exposure and consistency between public and expected records.
B · Application and API
B01 AuthenticationAuthentication resists brute-force and enumeration and offers multi-factor protection. Automated and manual check Pending
Public evidence summaryAuthentication resists brute-force and enumeration and offers multi-factor protection.
CheckCredential policy, multi-factor availability, brute-force and credential-stuffing protection, safe handling of failed logins and enumeration.
NoteUnder re-verification after the change of authentication provider.
B02 Session managementSessions are generated, rotated and invalidated correctly. Manual scenario Pending
Public evidence summarySessions are generated, rotated and invalidated correctly.
CheckSession identifier generation, rotation on privilege change, expiry, revocation on logout and concurrent-session handling.
NoteUnder re-verification after the change of authentication provider.
B03 Authorisation and rolesEvery tested function and object enforces the declared role model. Manual scenario Passed
Public evidence summaryEvery tested function and object enforces the declared role model.
CheckRole model enforcement on every function and object: horizontal and vertical privilege escalation, insecure direct object references, mass assignment.
B05 Input handling and injectionServer-side input handling resisted the injection classes in scope. Automated and manual check Passed
Public evidence summaryServer-side input handling resisted the injection classes in scope.
CheckServer-side injection classes — SQL, NoSQL, command, template, path traversal, server-side request forgery, XML external entities — across the endpoints in scope.
B06 Client-side securityNo exploitable client-side injection or request forgery was found. Automated and manual check Passed
Public evidence summaryNo exploitable client-side injection or request forgery was found.
CheckCross-site scripting (reflected, stored, DOM-based), cross-site request forgery, clickjacking and unsafe client-side storage.
B09 Rate limiting and abuse controlsResource-intensive operations are rate-limited. Automated check Passed
Public evidence summaryResource-intensive operations are rate-limited.
CheckLimits on authentication, messaging, export and other resource-intensive operations; protection against automated abuse.
Verification history
- Application submitted
- Certificate issued
- Material change reported
- Certificate suspended
Verify this record
The registry record behind this page is signed with the CyberSecurityV registry key. Your browser can verify the signature and the fingerprint without contacting anyone but the registry.
Record fingerprint (SHA-256): 9d8cca942b70f5007ba54391d3d18ce378daed759b1d22157927f23cf9249678
Registry signature (Ed25519): qNrx25qMw/7n7l9OqVUz7+knW4mD/Xvo6ow8bNm210kftwIJ9kKWsrH8UKMKnTeMaVQv/+NN7+HaQmlP0C+uCw==