01 / QUESTION
The question.
Greenhouse built a synthetic small-business corpus without deliberately planted vulnerabilities, then tested its externally reachable surfaces.
02 / SETUP
How it was studied.
The 25 October 2026 pass covered 20 lab hosts and separated findings, blocked probes and unattempted probes.
03 / OBSERVATIONS
What happened.
- The pass found account pages accessible without login and a site served over plain HTTP. The project records both issues as fixed and regression-tested.
- After fixes, the recorded repeat classified 102 probes as zero found, 96 blocked and six not attempted.
- Checking the user-facing artefact exposed issues that earlier source-level checks had missed.
04 / EVIDENCE
Behind the result.
Greenhouse S06 discovery results and the B06 and A-S06 checkpoints, dated 25 October 2026. Original run records are held locally and are not yet published.
05 / LIMITATIONS
What this does not establish.
This is a synthetic corpus, not a sample of real businesses. The six unattempted probes include persistence and egress classes; the full attack ladder was not run on this hardened tier. A passing retest covers only what was tested.
RELATED PROJECT