Penetration Test Report (IncludeSecurity): OTF BitPart 2025 Q3 Report v2

Security Assessment of Bitpart Servers, Cryptography,
and Dashboard on behalf of the Open Technology Fund
Page 1 of 21
Privileged and Confidential
Report
TABLE OF CONTENTS
Executive Summary ......................................................................................................................... 3
Include Security (IncludeSec) .................................................................................................................... 3
Assessment Objectives .............................................................................................................................. 3
Scope and Methodology ........................................................................................................................... 3
Findings Overview ..................................................................................................................................... 3
Next Steps ................................................................................................................................................. 3
Risk Categorizations ........................................................................................................................ 4
Critical-Risk ................................................................................................................................................ 4
High-Risk.................................................................................................................................................... 4
Medium-Risk ............................................................................................................................................. 4
Low-Risk .................................................................................................................................................... 4
Informational ............................................................................................................................................ 4
Introduction .................................................................................................................................... 5
High-Risk Findings ........................................................................................................................... 6
H1: All Users' Bot Data Listed via API Input .............................................................................................. 6
Medium-Risk Findings ..................................................................................................................... 8
M1: Invitation Code Bypass ...................................................................................................................... 8
M2: Insecure Direct Object Reference (IDOR) .......................................................................................... 9
M3: API Routes Exposed Without Authentication .................................................................................. 13
Low-Risk Findings .......................................................................................................................... 16
L1: Random Number Generator Does Not Produce High Entropy ......................................................... 16
L2: Cleartext Transmission of Security-Relevant Information ................................................................ 17
L3: GitHub Actions Not Pinned to a Hash ............................................................................................... 18
L4: Unsynchronized Bot Modification and Deletion ............................................................................... 19
Page 2 of 21
Privileged and Confidential
Report
EXECUTIVE SUMMARY
Include Security (IncludeSec)
IncludeSec brings together some of the best information security talent from around the world. The team is
composed of security experts in every aspect of consumer and enterprise technology, from low-level hardware
and operating systems to the latest cutting-edge web and mobile applications. More information about the
company can be found at www.IncludeSecurity.com.
Assessment Objectives
The objective of this assessment was to identify and confirm potential security vulnerabilities within targets in-
scope of the SOW. The team assigned a qualitative risk ranking to each finding. Recommendations were
provided for remediation steps which BitPart could implement to secure its applications and systems.
Scope and Methodology
Include Security performed a security assessment of Bitpart’s Servers, Cryptography, and Dashboard on behalf
of the Open Technology Fund The assessment team performed a 10 day effort spanning from July 7, 2025 – July
18, 2025, using a standard greybox assessment methodology which included a detailed review of all the
components described in a manner consistent with the original Statement of Work (SOW).
Findings Overview
IncludeSec identified a total of 8 findings. There were 0 deemed to be “Critical-Risk,” 1 deemed to be “High-
Risk,” 3 deemed to be “Medium-Risk,” and 4 deemed to be “Low-Risk,” which pose some tangible security risk.
Additionally, 0 “Informational” level findings were identified that do not immediately pose a security risk.
IncludeSec encourages BitPart to redefine the stated risk categorizations internally in a manner that
incorporates internal knowledge regarding business model, customer risk, and mitigation environmental
factors.
Next Steps
IncludeSec advises BitPart to remediate as many findings as possible in a prioritized manner and make systemic
changes to the Software Development Life Cycle (SDLC) to prevent further vulnerabilities from being introduced
into future release cycles. This report can be used by as a basis for any SDLC changes. IncludeSec welcomes the
opportunity to assist BitPart in improving their SDLC in future engagements by providing security assessments
of additional products. For inquiries or assistance scheduling remediation tests, please contact us at
remediation@includesecurity.com.
Page 3 of 21
Privileged and Confidential
Report
RISK CATEGORIZATIONS
At the conclusion of the assessment, Include Security categorized findings into five levels of perceived security
risk: Critical, High, Medium, Low, or Informational. The risk categorizations below are guidelines that
IncludeSec understands reflect best practices in the security industry and may differ from a client's internal
perceived risk. Additionally, all risk is viewed as "location agnostic" as if the system in question was deployed
on the Internet. It is common and encouraged that all clients recategorize findings based on their internal
business risk tolerances. Any discrepancies between assigned risk and internal perceived risk are addressed
during the course of remediation testing.
Critical-Risk findings are those that pose an immediate and serious threat to the company’s infrastructure and
customers. This includes loss of system, access, or application control, compromise of administrative accounts
or restriction of system functions, or the exposure of confidential information. These threats should take priority
during remediation efforts.
High-Risk findings are those that could pose serious threats including loss of system, access, or application
control, compromise of administrative accounts or restriction of system functions, or the exposure of
confidential information.
Medium-Risk findings are those that could potentially be used with other techniques to compromise accounts,
data, or performance.
Low-Risk findings pose limited exposure to compromise or loss of data, and are typically attributed to
configuration, and outdated patches or policies.
Informational findings pose little to no security exposure to compromise or loss of data which cover defense-
in-depth and best-practice changes which we recommend are made to the application. Any informational
findings for which the assessment team perceived a direct security risk, were also r