[
  {
    "phase": "Phase 14 - CORS",
    "title": "Wildcard Origin with Access-Control-Allow-Credentials",
    "severity": "HIGH",
    "pass": true,
    "details": "Access-Control-Allow-Origin: , Access-Control-Allow-Credentials: "
  },
  {
    "phase": "Phase 3 - IDOR / Session Ownership",
    "title": "Unauthenticated Session Access & Hijacking",
    "severity": "HIGH",
    "pass": false,
    "details": "Any unauthenticated client can send messages to session_id=ONB-C1CC0DA1. Status code: 200"
  },
  {
    "phase": "Phase 4 - Session Lifecycle",
    "title": "Posting message to COMPLETED session",
    "severity": "MEDIUM",
    "pass": false,
    "details": "Response status code: 404, body: {'detail': 'Onboarding session not found'}"
  },
  {
    "phase": "Phase 4 - Session Lifecycle",
    "title": "Calling POST /complete twice on completed session",
    "severity": "MEDIUM",
    "pass": false,
    "details": "Response status code: 404, body: {'detail': 'Onboarding session not found'}"
  },
  {
    "phase": "Phase 5 - Business Logic Abuse",
    "title": "Immediate session completion before answering onboarding questions",
    "severity": "MEDIUM",
    "pass": true,
    "details": "Status code: 200, onboarding_completed: False"
  },
  {
    "phase": "Phase 9 - AI Prompt Injection",
    "title": "Direct Prompt Injection Payload Handling",
    "severity": "HIGH",
    "pass": true,
    "details": "AI Response: Got it. How long has this issue been bothering you?"
  },
  {
    "phase": "Phase 7 - Input Validation",
    "title": "Unicode / Tamil / Emoji / Control Characters in Message",
    "severity": "LOW",
    "pass": true,
    "details": "Status code: 200"
  },
  {
    "phase": "Phase 13 - Error Information Disclosure",
    "title": "Malformed Request Error Response Structure",
    "severity": "LOW",
    "pass": true,
    "details": "Status: 422, Response: {'detail': [{'type': 'missing', 'loc': ['body'], 'msg': 'Field required', 'input': None}]}"
  }
]