# Entea penetration-test summary

Last updated: 18 September 2026  
Status: Independent penetration test pending

## Current position

Entea has not completed an independent third-party penetration test. There is no external report, attestation, testing firm, test date, or remediation letter to share. Entea must not be represented as penetration tested until that work is commissioned, completed, remediated, and approved for disclosure.

## Engineering evidence available today

- authenticated end-to-end coverage for sign-in and organization isolation;
- MFA enrollment and challenge coverage;
- tests for encrypted credential round trips and tamper rejection;
- server-side organization and role authorization on scoped APIs;
- source, build, health, accessibility, deployment, rollback, and cleanup evidence for the flagship reference application;
- explicit secret redaction in worker output paths;
- bounded URL and connector validation designed to reject embedded credentials and unsafe network targets.

This is internal engineering evidence. It is not a substitute for an independent adversarial assessment.

## Planned assessment scope before general availability

1. authentication, session lifecycle, MFA, and password recovery;
2. horizontal and vertical authorization across organizations and roles;
3. cloud, model, database, and connector credential handling;
4. build isolation, source extraction, generated code, and preview routing;
5. SSRF, injection, file-upload, and supply-chain boundaries;
6. deployment, rollback, deletion, backup, and restore controls;
7. public APIs, service tokens, SCIM, rate limiting, and audit integrity.

The public summary will be updated with the assessor, assessment window, tested version, scope, severity counts, remediation status, and retest result only after those facts exist.