STCSENDTHECANARY
TREN
Start a test

SAMPLE REPORT

API and backend service

The report below comes from testing a payment integration API.

Cases tested
416
Total findings
24
Release blockers
3

Test summary

416 request scenarios were tested across 41 endpoints over three business days. 24 findings were reported; 3 would break data integrity.

Cases tested
416
Total findings
24
Release blockers
3
Closed on re-test
22

Severity distribution

3Critical
8High
9Medium
4Low
CLIENT
Anonymous · fintech
PACKAGE
Release
DATES
5–7 April 2026
ENVIRONMENT
staging · REST v2 · 41 endpoints

Coverage matrix

Each square is one endpoint-scenario pair. Coloured squares carry findings.

PassedCriticalHighMediumLow

Finding cards

Five of the 38 findings in the report. Each card is exactly the format you'll see in yours.

4 / 4 showing
CriticalCNRY-402Order creationstaging · 2 parallel requests

Two parallel requests create the same order twice

Steps to reproduce

  1. Send two requests concurrently with the same idempotency key.
  2. Query the order list.
  3. Check the accounting record.
Expected
The second request returns the same order and creates nothing new.
Actual
Two separate orders are created and the customer is charged twice.
Impact
The idempotency key is never checked. Direct financial impact.
Evidence
har-402.json · db-402.sql
CriticalCNRY-411Authenticationstaging · expired token

An expired token is still accepted on four endpoints

Steps to reproduce

  1. Obtain a token and wait for it to expire.
  2. Call all 41 endpoints with the expired token.
  3. Compare the status codes returned.
Expected
Every endpoint returns 401.
Actual
Four endpoints return 200 and serve data.
Impact
A stolen token keeps working after expiry.
Evidence
report-411.json
HighCNRY-419Listingstaging · 120,000 records

No pagination limit: one request returns the whole table

Steps to reproduce

  1. Call the listing endpoint with limit=999999.
  2. Measure the response size and duration.
  3. Watch server memory.
Expected
The server applies an upper bound and returns a paged response.
Actual
120,000 records come back in one 86 MB response and the request takes 41 seconds.
Impact
A single request degrades the service — an easy denial-of-service path.
Evidence
k6-419.html
MediumCNRY-428Validationstaging · malformed input

An invalid date format returns 500 where it should return 400

Steps to reproduce

  1. Send “2026-13-45” in the date field.
  2. Inspect the status code and the body.
  3. Check the server log.
Expected
400, with a body naming the field that failed.
Actual
500 is returned and the body contains a stack trace.
Impact
Clients cannot handle the error, and the stack trace exposes internals.
Evidence
har-428.json

The report keeps living after handover

The web report is a link, not a dead PDF. Its status updates as you mark fixes, and after the re-test round every finding's outcome shows up in the same place.

A report for another product type

Website and web applicationE-commerce, SaaS panels, corporate sites — anything that runs in a browser.Mobile appiOS and Android, on real devices and real connections.Desktop applicationWindows and macOS, including install, update and offline behaviour.

Don't test the next release alongside your users.

Sign up in the panel, pick what you want tested, pay. The first findings start landing in the same panel within hours.

Start a testRead a sample report

SendTheCanary provides independent software testing for web, mobile and API products. Ten separate services from functional testing to payments and localization, run by a network of 4,700 testers and delivered as one report ranked by severity.

Services:Functional testingRegression testingCompatibility matrixPerformance & loadSecurity reviewAPI testingPayment testingAccessibilityUsability reviewLocalization testing