GUARDVEST CLEARSIGHT / ILLUSTRATIVE SAMPLE

See what your team would get.

An example of how ClearSight turns a code scan into prioritized engineering work.

Illustrative example only. Fictional company, code paths, findings and results. No customer code or real credentials are shown.

Executive summaryGuardVest / Sample / 01

Northstar Commerce
Sample assessment.

Leadership takeaway: The first priority is credential rotation because an exposed key may be usable immediately. Next, close a potential cross-account invoice access path. Then upgrade the image library used by the upload workflow.

This abbreviated report shows three example findings. A real ClearSight assessment is scoped to the customer’s repository and includes reviewed findings, priorities and technical remediation guidance.

1Critical
1High
1Medium
Fix firstGuardVest / Sample / 02

The first decisions are clear.

  1. Now: rotate the exposed key.Revoke the old credential, deploy its replacement and review provider activity.
  2. Next: close cross-account access.Require account ownership on invoice reads, downloads and updates; test with two accounts.
  3. Then: upgrade the library.Move to the fixed sample version and test the upload flow.
Selected findingsGuardVest / Sample / 03

Each finding connects the affected location to risk, a specific action and a way to verify the fix.

GV-001Critical

Production credential committed to the repository

Affected location config/payment.ts:18 · current branch and earlier commit

Illustrative evidence excerptPAYMENT_API_KEY = "[REDACTED SAMPLE VALUE]"

What we observed

A credential is assigned directly in application configuration. The mock history shows the same value in an earlier commit, so deleting the current line alone would leave it in clones and history.

Business impact

Someone with repository access could use the credential against the payment provider. The actual permissions and any misuse require provider-side review.

What to do

Revoke the old key first. Issue a restricted replacement through the secrets manager, update the application to read it at runtime, then remove the old value from history. Review provider activity during the exposure window.

How to confirm the fix

Old key rejected; new key works in staging; code and history checks show no credential; provider activity review documented.

Suggested owner: Engineering + service owner

GV-002High

Invoice lookup lacks an account ownership check

Affected location src/api/invoices.ts:74 · GET /invoices/:id

Illustrative evidence excerptreturn invoiceStore.findById(request.params.id)

What we observed

The route uses the invoice ID supplied by the requester without also constraining the query to the authenticated account. This is a code-level exposure path, not proof that data was accessed.

Business impact

If reachable as shown, a signed-in user who learns another invoice ID could retrieve another account’s billing details.

What to do

Resolve the authenticated account from the server-side session. Query by both invoice ID and account ID, return a denial or not-found response for mismatches, and apply the same ownership check to download and update routes.

How to confirm the fix

With two test accounts, each retrieves its own invoice and cannot retrieve or download the other account’s invoice. Add that test to CI.

Suggested owner: API engineering

GV-003Medium

Image processing dependency needs an upgrade

Affected location package-lock.json:412 · sample-image-lib 2.3.1

Illustrative evidence excerpt"sample-image-lib": "2.3.1" → fixed sample version 2.3.4

What we observed

The illustrative dependency version is affected by a hypothetical advisory. The application’s upload route invokes its image parser, so this merits review beyond a version match.

Business impact

Crafted uploads could reach affected parsing logic. This sample does not claim exploitation or a confirmed runtime path in any real application.

What to do

Upgrade to the fixed version, run upload and image transformation tests, and confirm file type and size limits at the upload boundary.

How to confirm the fix

Lockfile and deployed build use the fixed version; dependency check is clear; representative uploads continue to work.

Suggested owner: Application engineering

What the full engagement includesGuardVest / Sample / 04

A report your team can work from.

The full ClearSight deliverable includes an executive summary, a fix-first list, reviewed technical findings, a tracking spreadsheet and documentation of source-code handling.

Actual findings depend on the assessment scope. This public example omits real repository evidence, raw scanner output and internal detection methods.

Explore GuardVest ClearSight