# GQueries production penetration test — public report

**Assessment:** Authorized external black-box penetration test
**Tool:** Strix
**Completed:** August 21, 2026
**Run:** `www-aletheionagi-com_831e`
**Result:** No exploitable vulnerabilities detected

## Run facts

- Mode: deep external black box
- Targets: 2
- Duration: 1 hour 15 minutes
- LLM requests: 789
- Total tokens: 90,364,749 (89,048,832 cached input tokens)
- SARIF findings: 0

## Executive summary

An authorized external black-box assessment covered the GQueries production website
and public API, with emphasis on the Black-Box Protocol and tenant isolation across two
provisioned test organizations.

No exploitable vulnerabilities were confirmed. No unauthorized read or mutation,
cross-tenant data exposure, privilege escalation, payment-flow abuse or service disruption
was demonstrated under the tested vectors. The machine-readable SARIF output contained
zero findings.

## Targets

- `https://gqueries.com`
- `https://api.gqueries.com`

## Methodology

The engagement used an external black-box approach informed by OWASP WSTG and PTES-style
reconnaissance and testing. It included public attack-surface mapping, review of the public
OpenAPI contract and Black-Box Protocol, and authenticated differential testing with two
test organizations.

Testing covered:

- portal tenant isolation, IDOR/BOLA and mass assignment;
- organization switching and session revocation;
- API-key permission, namespace and environment scoping;
- cross-tenant memory, query, grounding and usage isolation;
- metering, idempotency and replay behavior;
- billing and checkout authorization;
- injection and stored-XSS reflection probes;
- support-ticket isolation and anonymous quote tampering.

The assessment used bounded request rates and synthetic canaries. It excluded denial-of-service,
credential stuffing, phishing, persistence and attacks against third-party infrastructure.

## Observed outcome

The tested server-side authorization and tenant boundaries held. Cross-tenant operations were
denied, revoked sessions and keys ceased to authorize access, managed namespace policies stayed
within their assigned boundary, and usage balances remained isolated by organization.

Input validation rejected malformed identifiers and injection payloads. User-controlled portal
names were encoded when rendered. No candidate anomaly met the reporting threshold of a
reproducible unauthorized read or mutation.

## Hardening recommendations

The assessment recorded non-exploitable defense-in-depth and operational recommendations:

1. Keep the deployed API contract aligned with implemented routes.
2. Return consistent fail-closed 403/404 responses for denied cross-tenant mutations.
3. Minimize unauthenticated readiness metadata.
4. Maintain authentication-before-validation ordering where practical.
5. Continue improving tenant lifecycle cleanup and revoked-session user experience.
6. Repeat two-tenant differential tests after authorization or billing changes.

These observations were not confirmed exploitable vulnerabilities and do not change the
zero-finding result.

## Interpretation boundary

This result is scoped to the production surfaces, accounts, controls and time window tested.
A zero-finding assessment does not prove that a system is free of all vulnerabilities. It is
evidence that no exploitable vulnerability was confirmed within this authorized engagement.

This public edition intentionally omits credentials, session material, API keys, internal fixture
identifiers and operator-only cleanup details.