Attestation dated October 23, 2026
The attestation letter: Third-Party Penetration Test Attestation, October 2026 (PDF, 3 pages). Signed by MSP Pentesting LLC for M4 Labs LLC, the company that operates VisionXLab. Forward it to your compliance or vendor management team as it is.
1. Results
No critical, high or medium severity findings were identified. One low severity finding and one informational finding were reported to us in the Penetration Test Report v1.1, dated October 23, 2026.
| Severity | Findings |
|---|---|
| Critical | 0 |
| High | 0 |
| Medium | 0 |
| Low | 1 |
| Informational | 1 |
The tester also verified these controls, in the letter’s own terms:
- No personal data was retrievable on the no-data-retention lead path.
- Database access is deny-by-default, and no row-level security bypass was found.
- Lead routing could not be altered after intake.
- Update tokens were enforced.
The low severity finding was reported to us with a remediation recommendation. By the tester’s scale, a low finding gives limited exposure and has value to an attacker only when combined with a higher-risk issue.
2. What was tested
An external, authenticated (grey-box) web application and API penetration test, including vulnerability scanning of our internet-facing systems. The scope:
- The application: our consumer landing pages and lead forms, and the admin application.
- The APIs: the API gateway and the backend edge functions.
- Access controls: authentication, two-factor authentication, authorization and database row-level security.
- Integrations and data flows: lead delivery into client CRMs, and the no-data-retention lead path.
- Environment configuration: TLS, security headers and secrets management.
3. How it was tested
Manual testing aligned with the OWASP Testing Guide, NIST SP 800-115 and the Penetration Testing Execution Standard (PTES), supplemented by automated tooling. Findings were rated Critical, High, Medium, Low or Informational on the tester’s scale, which is derived from OWASP and the Common Weakness Enumeration (CWE) and is printed in the letter’s appendix.
4. Who tested it
MSP Pentesting LLC, also operating as Affordable Pentesting, an independent U.S.-based penetration testing firm. The assessment was performed by its Security Lead, who holds the CompTIA CySA+ certification, and the letter carries the tester’s name and contact details.
The firm operates independently of M4 Labs LLC. All testing, findings and reporting were done by its own personnel, not by us.
5. What this test is, and what it is not
- It is a point-in-time test of the systems in scope, run October 19 to 23, 2026.
- It is not a SOC 2 report or an ISO 27001 certification, and we do not hold either.
- The full report is not public. The attestation letter is the summary the firm signed for third parties.
6. For your vendor approval
If your company has to approve us as a vendor, we fill in your security and compliance questionnaire, and no lead is delivered to you before your approval clears. What else we fill in is in our FAQ under setting us up as a vendor, and what to forward with this letter is in what to send your compliance team before you buy mortgage leads.
Found a security issue yourself? Our contact for it is in our security.txt.
© 2026 VisionXLab · M4 Labs LLC. All rights reserved.