Security testing letter
This letter confirms that Ryvx carried out a security review of OWASP Juice Shop, on the date and in the way described below. It is a record of what was tested. It is not a certification. You can share this page with your clients, customers or insurer; the rest of the report stays confidential.
- Site tested
- OWASP Juice Shop (practice site)
- Date
- 3 September 2026
- Review
- First review
- Permission
- The site owner signed our permission form, and we checked the site is theirs, before testing.
- How
- Tested from the internet the way an attacker would, by our software, with every issue checked by a person before release. Read-only: nothing on the site was changed.
- Signed-in pages
- Not tested
- Found
- 15 issues: 2 to fix this week, 6 to fix this month, 7 worth fixing. Details are in this report.
- Not covered
- Internal networks, social engineering, pages behind a login, services run by other companies, and anything outside the sites above.
No test can prove a site is secure. Ryvx is not CREST accredited and is not a PCI Approved Scanning Vendor. Questions about this letter: harry@ryvx.dev.