WEB SERVICE REVIEW SHEET
Yenra | October 12, 2026
Guide: https://yenra.com/web-services-vulnerabilities/

For an authorized service owner and reviewer. Use fictional accounts and data
in a controlled environment. This is an evidence record, not a testing script.
Keep completed system details private. Omit passwords, keys and sensitive data.

Service / operation / owner: ______________________________________________
Review date / deployed version / environment: ______________________________
Caller -> service -> dependencies -> response: _____________________________
Required task and permitted records: ______________________________________
Authentication method / effective authorization rule: ______________________

ACCESS
Permitted fictional account and record / expected result: _________________
Denied fictional account and record / expected result: ____________________
Observed results / response fields / evidence reference: ___________________

XML AND INPUT (mark not applicable where appropriate)
Parser and library version: _______________________________________________
Effective DTD / external-resolution settings: ______________________________
Schema and application validation rules: __________________________________
Unsupported-setting handling / observed result: ____________________________

RESOURCE LIMITS
Request size / processing time / concurrency limits: _______________________
Downstream work, retries and queued-job limits: ____________________________
Approved verification / observed behavior / evidence: ______________________

OPERATIONS
Useful event fields, with sensitive payloads excluded: _____________________
Event-review owner / response route: _______________________________________
Gap | next action | accountable owner | due date | verification
__________________________________________________________________________
__________________________________________________________________________
Recheck affected boundaries after authentication, parser, dependency or
data-access changes. Guidance sources: OWASP references linked in the guide.