Skip to content

Synthetic demo · No customer connectors attached · Fixture snapshot 24 Sep 2026, 06:15 UTC

Respond / Synthetic demo

Findings

Each finding states why its severity was assigned, and keeps potential access strictly separate from what was actually observed leaving the boundary.

Observed at 24 Sep 2026, 06:15 UTC5 of 5 fixture findings shown · no live collection

1 finding rests on stale evidence. Its current state is unknown until collection recovers; it is not closed by silence.

Finding work queue

Prioritized by severity while preserving evidence freshness and disclosure semantics.

Scroll table sideways for more columns →

FindingSeverityStatusPotential accessObserved disclosureEvidenceDetected
Revoked users can still retrieve chunks from support-eu-v12

fnd-2291 · R24 — index ACL drift

criticalmitigating2 paths1 observedPass24 Sep 2026, 02:35 UTC
Blind interval: EU prompt-log collector silent for 3h11m

fnd-2304 · R41 — missing telemetry read as no incidents

mediumopen1 pathsNone observedPass22 Sep 2026, 19:40 UTC
Contract content used as a training input under a deny decision

fnd-2277 · R09 — unauthorized training purpose

criticalopen2 paths1 observedPartial9 Sep 2026, 08:15 UTC
Code agent holds 9 MCP tools beyond its approved purpose

fnd-2312 · R33 — excessive agency

highopen2 pathsNone observedPass24 Sep 2026, 05:05 UTC
Unowned restricted HR dataset in an active development use case

fnd-2260 · R05 — orphaned data with no owner or purpose

highopen2 pathsNone observedStale8 Sep 2026, 12:30 UTC