- Need to use the tools
- Below is defined which tools are suitable
- Need evidences
- Not worked on it
- At the end draft is ready(may be changed according to to evidences)
Optimsync’s annual penetration-testing program targets the layers on Google Cloud (GCP)—not Google’s own hypervisor—so the attestation you upload to Vanta will cover your App Engine & Cloud Run services, Cloud SQL (PostgreSQL), IAM/VPC settings, and the SaaS components you bolt on (Auth0, dbt Cloud, Fivetran). The table below lists the industry-standard tools most teams use to test this stack, and the short narrative afterwards explains exactly what the attestation must show and why it applies only to product environment.
Public entry points that run Optimsync’s code.
Holds customer data; check SQL-i, auth & network paths.
VPC firewalls, IAM, Storage buckets
Misconfigurations expose the whole tenant.
Auth0 Universal Login, OAuth flows
External IdP your users rely on.
dbt Cloud jobs, Fivetran connectors
Tokens & webhooks must be locked down.
Google keeps the underlying physical infrastructure safe, but every row above is under the shared-responsibility model.
Catch weak IAM roles, open buckets, permissive firewalls
scans GCP APIs; maps findings to CIS benchmarks ; native detectors
Discover OWASP Top-10 flaws in App Engine / Cloud Run
(free) with exportable PDF reports
Probe Cloud SQL for SQL-i, weak creds
automates injection & privilege checks
Verify token scope, callback safety
ZAP/Burp plus IDOR & OAuth test scripts; Auth0 permits such tests with pre-notification
Produce auditor-friendly docs
Burp/ZAP native reports or templates like Report-NG
All of these tools operate entirely in-tenant, so they (no DoS, no hypervisor calls) .
- List of URLs/IPs for every layer above.
- Statement referencing NIST SP 800-115 or OWASP WSTG methodology.
- Test dates, tester credentials, and version of each tool used.
- CVSS-rated vulnerabilities, proof-of-concepts, and affected assets.
- Remediation tracker showing “Fixed”, “Risk-Accepted”, or “False-Positive” status for each issue—mapped to your SLA policy.
- Signed letter that the tester was of the build team (SOC 2 CC7.1 requirement)
- Provider notifications/approvals (Auth0, dbt Cloud, Fivetran) attached to show rules were followed.
Optimsync [Insert Date Range, e.g., May 15–May 22, 2025] [Insert Name of Third-Party Firm, Internal Security Team, or Tool Name] [Insert Reviewer Name/Role]
- Auth0 (Authentication and Identity Management)
- Google Cloud Platform (GCP) – Cloud Run, App Engine
- PostgreSQL (managed on GCP)
Testing was conducted in accordance with industry standards (e.g., , , ). The assessment included both and covering:
- Web application vulnerabilities (OWASP Top 10)
- API and endpoint security
- Authentication and authorization controls
- Cloud configuration and IAM security
- Database exposure and SQL injection
- Identity provider configuration (Auth0 best practices)
- Verified configuration of callback URLs, token security, and MFA.
- Tested for weak JWT algorithms, open redirect, and authentication bypass.
- Assessed public endpoints for unauthorized access.
- Checked IAM policies for over-privileged roles.
- Performed web/API scanning for vulnerabilities (e.g., using OWASP ZAP/Burp Suite).
- Verified database firewall rules and public exposure.
- Tested for SQL injection via API/application layers.
- Reviewed role and privilege assignments.
Manual Review, auth0-labs tools
Checked Auth0 logs, MFA, rules, configs
API/web endpoint scanning
SQL injection testing, privilege review
IAM, network, and storage configuration scan
[e.g., Open admin endpoint]
[e.g., Excessive IAM privileges]
[e.g., Outdated dependency]
[e.g., Informational server headers]
- All vulnerabilities were remediated within [X] days of discovery.
- [List examples, e.g., disabled public endpoint on Cloud Run, enabled MFA on Auth0, restricted database firewall rules.]
- were either remediated or risk accepted with documented business justification.
- Remediation tracked in [Jira, GitHub, or ticketing system]—see attached evidence.
- [If applicable:] Accepted risk for [describe finding], documented in risk register and approved by [risk owner/management].
- Third-party or automated penetration test report(s) (PDF/HTML)
- Screenshots of tool dashboards/findings
- Remediation ticket logs/exports
- Email or sign-off for review/approval
- Risk acceptance documentation
This penetration test was completed in accordance with [relevant company policy, e.g., annual/quarterly testing requirement] and industry standards.All critical and high-risk vulnerabilities were resolved or risk accepted in line with the company’s policy and regulatory requirements.
Name: ___________________Role: ___________________Date: ___________________
Name: ___________________Role: ___________________Date: ___________________
Attach all required evidence (reports, screenshots, remediation logs) when available.Update this document upon completion of remediation and acceptance activities.