{
  "contract": "eva.integration.report.v1",
  "profile": "report_core",
  "generated_at": "2026-08-20T16:00:00+00:00",
  "report_type": "technical",
  "project": {
    "id": "11111111-1111-4111-8111-111111111111",
    "name": "Example web application assessment",
    "code": "EX-WEB-001"
  },
  "client": {
    "code": "ACME",
    "name": "Acme Corporation"
  },
  "scenario": {
    "id": "22222222-2222-4222-8222-222222222222",
    "title": "External web application",
    "scenario_key": "web.external.default",
    "family_key": "web",
    "variant_key": "external",
    "status": "execution"
  },
  "counts": {
    "vulnerabilities": 1,
    "assets": 1,
    "evidences": 2,
    "positive_aspects": 1,
    "incidents": 1
  },
  "assets": [
    {
      "id": "33333333-3333-4333-8333-333333333333",
      "asset_type": "url",
      "value": "https://app.example.test",
      "label": "Customer portal"
    }
  ],
  "vulnerabilities": [
    {
      "id": "44444444-4444-4444-8444-444444444444",
      "title": "Missing security headers on public login",
      "severity": "medium",
      "status": "open",
      "category": "configuration",
      "cvss_score": 5.3,
      "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "cwes": ["CWE-693"],
      "description": "The public login page does not send recommended browser security headers.",
      "impact": "A browser-based attacker may have a larger room to inject or leak contextual data.",
      "recommendation": "Send a baseline of security headers (CSP, HSTS, frame-ancestors) on all public responses.",
      "linked_asset_ids": ["33333333-3333-4333-8333-333333333333"]
    }
  ],
  "positive_aspects": [
    {
      "id": "55555555-5555-4555-8555-555555555555",
      "title": "TLS 1.2+ enforced on the public edge",
      "description": "The public endpoint rejects legacy TLS versions.",
      "created_at": "2026-08-18T10:15:00+00:00",
      "updated_at": "2026-08-18T10:15:00+00:00"
    }
  ],
  "incidents": [
    {
      "id": "66666666-6666-4666-8666-666666666666",
      "caption": "Brief availability window during test",
      "description": "The login page returned HTTP 503 for two minutes; service recovered without intervention.",
      "incident_date": "2026-08-19",
      "start_time": "14:02:00",
      "end_time": "14:04:00"
    }
  ]
}