Avaliação externa de segurança

SIMULATED HTTP EXCHANGE — NOT EXECUTED AGAINST A REAL SYSTEM

GET /v1/orders?limit=2 HTTP/1.1
Host: partner-api.velanorte.example
Accept: application/json
[No Authorization header; no cookies]

HTTP/1.1 200 OK
Content-Type: application/json

{
  "total": 642,
  "items": [
    {"id": "DEMO-4101", "organization": "DEMO-A",
     "buyer": "Synthetic Buyer A",
     "email": "buyer-a@customer-a.example",
     "billing_address": "SYNTHETIC ADDRESS A"},
    {"id": "DEMO-4102", "organization": "DEMO-B",
     "buyer": "Synthetic Buyer B",
     "email": "buyer-b@customer-b.example",
     "billing_address": "SYNTHETIC ADDRESS B"}
  ]
}

SIMULATED NEGATIVE CHECK
GET /v1/orders/DEMO-NOT-FOUND → HTTP 404
An unknown identifier returning 404 does not establish access control.

SIMULATED HTTP EXCHANGE — NOT EXECUTED AGAINST A REAL SYSTEM

GET /releases/connector/demo-2026.05/config.json HTTP/1.1
Host: builds.velanorte.example
[No Authorization header; no cookies]

HTTP/1.1 200 OK
Content-Type: application/json

{
  "environment": "production",
  "integration_endpoint": "https://api.velanorte.example",
  "service_secret": "[SYNTHETIC SECRET OMITTED]",
  "credential_type": "backend_service"
}

The placeholder is not a credential. No authentication was attempted.
Credential validity, privileges and downstream access were not tested.

SIMULATED COMPARISON — ALL RECORDS ARE FICTIONAL

GET /v1/orders?limit=2
Host: sandbox-api.velanorte.example
[No Authorization header; no cookies]

HTTP/1.1 200 OK
Content-Type: application/json

{
  "environment": "sandbox",
  "items": [
    {"id": "DEMO-4101", "organization": "DEMO-A",
     "buyer": "Synthetic Buyer A"},
    {"id": "DEMO-4102", "organization": "DEMO-B",
     "buyer": "Synthetic Buyer B"}
  ]
}

The two sampled identifiers and buyer labels match EV-01.
No statement is made about the origin or contents of the entire database.

SIMULATED EDGE / ORIGIN COMPARISON

A. PUBLIC EDGE
GET /internal/status HTTP/1.1
Host: app.velanorte.example
→ HTTP/1.1 403 Forbidden

B. DIRECT ORIGIN — documentation-only address 198.51.100.42
GET /internal/status HTTP/1.1
Host: app.velanorte.example
→ HTTP/1.1 200 OK
Content-Type: application/json

{
  "service": "demo-customer-portal",
  "environment": "production",
  "release": "demo-2026.06",
  "upstream": "api.internal.example"
}

Only this status route is represented. No general WAF bypass,
privileged action or service disruption was demonstrated.