Book a demo

THE ROOM / LIVE SECURITY TESTING

A shared workspace
for application
security testing.

The Room brings engineers, security engineers and BattleTest AI into one live assessment. Follow the AI’s tests, discuss what it finds, add application context and direct the next test.

See how the Room works Book a demo

Included in BattleTest Enterprise · Self-hosted

Watch the walkthrough 2:07
HIGHILLUSTRATIVE FINDING

Invoice accessible
from another account

A user in the Northstar account could read an invoice belonging to a different account, Juniper.

Expected
Deny access to another account’s invoice.
Observed
Returned Juniper’s invoice with HTTP 200.
GET /api/invoices/inv_2048200 OK

Wonderland / sample application / fictional assessment

01 / INSIDE AN ASSESSMENTHow the room works

Explore the application with two test accounts.

In this example, Northstar and Juniper are separate customer accounts. BattleTest signs in to each and identifies their invoice routes.

Read the evidence
BattleTest
Wonderland · productionwonderland.drreamer.digital
Discovering
10:24
DISCOVERY
Signed in with the supplied test account. Discovered /workspace, /api/invoices and /settings/team.
10:24
RECON
Mapped two isolated test workspaces: Northstar and Juniper. Both use the same invoice endpoint.
Only the people in this room
@ mention · # reference a step · Enter sends, Shift+Enter newlines
Example run
02 / BEFORE THE RUN

Choose a target.
Set testing permissions.

Add a domain, select a permission tier and assign it to an environment. Manage the deployment’s permitted targets in Settings.

New targetSetup overview

01 / DOMAIN

wonderland.drreamer.digital

02 / PERMISSION TIER

Read Only

Passive recon only

Safe Probing

Light active checks

Active Probing

Active scanning, no exploitation

Exploit Chain

Full exploitation authorised

03 / ASSIGN ENVIRONMENT

ProductionWonderland
TESTING SCOPE

Restrict testing to selected domains or network ranges in Settings. Enterprise targets do not require DNS verification.

TEAM CONTEXT → NEXT TEST

Use application context
to direct testing.

Bring the engineer who knows the workflow into the live test. They can explain expected behaviour while a security engineer directs BattleTest. Keep that discussion with the requests and results used to investigate the issue.

See the conversation
MAMayaTeam message

We moved billing onto the shared invoice API last release.

ALAlexOperator directive

/focus /api/invoices — check access between accounts

@battletestBattleTestAgent

I’ll test whether one account can read another account’s invoices. I’ll repeat the request using a separate signed-in session.

03 / FINDINGS AND EVIDENCE

Findings engineers
can investigate.

See the affected endpoint, the request that exposed the issue and the suggested correction. Export the finding to share it with the engineer working on the fix.

HIGHBroken access control · CWE-639

Invoice accessible from another account

A Northstar user can retrieve an invoice owned by Juniper.

Observed behaviour
Northstar’s authenticated session receives HTTP 200 and an invoice owned by Juniper.
Consequence
A user can read invoice data outside their own account.
Suggested correction
Enforce invoice ownership on the server before returning the document. Add a cross-account access test.
Download example JSON ILLUSTRATIVE
REPRODUCTION / HTTP

Authenticated as Northstar

GET /api/invoices/inv_2048
Authorization: [REDACTED]
HTTP 200application/json
{
  "id": "inv_2048",
  "account_name": "Juniper",
  "total_cents": 24900,
  "status": "paid"
}
Full request and response 
[
  {
    "requestMethod": "GET",
    "requestUrl": "https://wonderland.drreamer.digital/api/invoices/inv_2048",
    "requestHeaders": {
      "Authorization": "[REDACTED]"
    },
    "responseStatus": 200,
    "responseHeaders": {
      "Content-Type": "application/json"
    },
    "responseBody": "{\n  \"id\": \"inv_2048\",\n  \"account_id\": \"account_b\",\n  \"account_name\": \"Juniper\",\n  \"currency\": \"USD\",\n  \"total_cents\": 24900,\n  \"status\": \"paid\"\n}",
    "responseTimeMs": 84,
    "capturedAt": "2026-09-24T10:26:30.000Z"
  }
]

SEE THE ROOM IN ACTION

Walk through an
investigation with us.

Book a demo Explore Enterprise