# Bastion — Buyer-Safe Security Report (redacted)

**Asset:** audioprism.pro (saas)  
**Assessment depth:** Adversarial  
**Date:** 2026-09-13

> This report is redacted for sharing. Every finding from the assessment appears below, sorted into what was **verified** from live responses, what was **observed but not asserted**, and what requires **independent validation**. Sensitive evidence (paths, secrets, IPs) is withheld.

## Posture: STRONG — 85/100

**Verified:** 7 · **Observed, not asserted:** 0 · **For independent validation:** 0 · **Total:** 7

## Verified findings (redacted)

- **[MEDIUM · moderate]** Exposed service: SSH on port 22
  - Impact: A SSH service is reachable from the public internet; every exposed service is an entry point that must be patched and access-controlled.
  - Evidence: TCP connect to audioprism.pro:22 succeeded; a service banner was returned (41 bytes, withheld).
  - Ref: `bb4a963bb185`
- **[LOW · moderate]** Weak Content-Security-Policy ('unsafe-inline', 'unsafe-eval')
  - Impact: A CSP with unsafe directives or wildcards barely constrains injected script.
  - Evidence: CSP contains: 'unsafe-inline', 'unsafe-eval'
  - Ref: `4e975805941c`
- **[LOW · hygiene]** No CAA record
  - Impact: Any public certificate authority may issue a certificate for this domain, widening the mis-issuance risk.
  - Evidence: A CAA query returned no records, so any public CA may issue certificates for this domain. Established by a public DNS lookup of audioprism.pro.
  - Ref: `6f90209ab146`
- **[LOW · moderate]** Exposed service: HTTP-alt on port 8080
  - Impact: A HTTP-alt service is reachable from the public internet; every exposed service is an entry point that must be patched and access-controlled.
  - Evidence: TCP connect to audioprism.pro:8080 succeeded; no banner returned.
  - Ref: `e82925730dd3`
- **[INFO · hygiene]** No MTA-STS
  - Impact: Inbound mail can be delivered over an unencrypted connection if an attacker strips TLS.
  - Evidence: No TXT record containing "v=STSv1" was returned for _mta-sts.audioprism.pro. Established by a public DNS lookup of audioprism.pro.
  - Ref: `8e6321f76345`
- **[INFO · moderate]** Exposed service: HTTP on port 80
  - Impact: A HTTP service is reachable from the public internet; every exposed service is an entry point that must be patched and access-controlled.
  - Evidence: TCP connect to audioprism.pro:80 succeeded; no banner returned.
  - Ref: `41794e278737`
- **[INFO · moderate]** Exposed service: HTTPS on port 443
  - Impact: A HTTPS service is reachable from the public internet; every exposed service is an entry point that must be patched and access-controlled.
  - Evidence: TCP connect to audioprism.pro:443 succeeded; no banner returned.
  - Ref: `12e9c1d4a9a8`

_Methodology: external, read-only assessment. No exploitation performed. Findings requiring active testing are flagged, not proven._