Verification Links

The Last Mile of Trust

Blockchain attestation creates a tamper-proof record of a pentest's results. But attestation is only useful if the people who need to verify it can actually do so. An auditor reviewing your SOC 2 evidence does not want to install a crypto wallet, navigate a block explorer, or compute SHA-256 hashes by hand. Verification links bridge this gap by providing a simple, shareable URL that presents the attestation and its on-chain anchor.

What Is a Verification Link?

A verification link is a unique URL that points to TurboPentest's public verification page for a specific pentest attestation. When someone visits the link, they see:

• Engagement details - Credit tier, risk score, agent hours, duration, tools run, and completion date
• Finding summary - Counts of findings by severity (critical, high, medium, low, info)
• Cryptographic proof - The attestation hash, target hash, and report hash
• On-chain anchor - Once the attestation batch is anchored: the Merkle root, the Base L2 transaction hash (linked to a block explorer), the chain ID, and the block number
• Link expiry - A countdown showing how long the link remains valid

The verification page does not display any report contents - no finding details, no evidence, no remediation guidance. The target domain itself is shown only if the link was created with the reveal-target option enabled. An auditor can confirm that a pentest was conducted with specific attested results without seeing the findings themselves. This separation is critical - the organization controls who sees the actual report, while verification of its existence and integrity is shareable.

Generating Verification Links

Verification links are created on demand. Downloading a pentest's attestation letter automatically creates one (valid for one year, with the target revealed) and embeds it in the letter along with a QR code. Links can also be created explicitly for an attestation, with a configurable expiry (30 days by default, up to 365) and an opt-in flag controlling whether the target domain is revealed.

Each verification link contains a unique token that maps to the pentest's attestation record. The token is a cryptographically random identifier - it cannot be guessed, and knowing one link does not reveal links for other pentests.

The link format follows:

https://turbopentest.com/verify/{token}

The on-chain attestation itself persists independently on Base L2, so even if a link expires or TurboPentest's verification page were unavailable, the anchored Merkle root remains on the blockchain.

The Verification Process

When an auditor or customer visits a verification link, the system performs these steps automatically:

Step 1: Link Resolution

The token is resolved to the attestation record. If the link has expired, an error explains that the pentest owner can generate a new one. Each access updates the link's last-accessed timestamp.

Step 2: Attestation Display

The page shows the attested engagement details, the finding summary by severity, and the cryptographic hashes (attestation hash, target hash, report hash).

Step 3: On-Chain Anchor Display

If the attestation's batch has been anchored, the page shows the Merkle root, the Base L2 transaction hash linked to a block explorer, the chain ID, and the block number. If the batch has not yet been anchored (anchoring runs on a daily schedule), the on-chain section is not yet available and appears after the next anchoring run.

Sharing Verification Links

Verification links are designed for different audiences:

For Auditors

When an auditor requests evidence that a penetration test was conducted, you share three things: the PDF report, the report password, and the verification link. The auditor can:

1. Open the report with the password to review findings
2. Visit the verification link to confirm the attested engagement details and finding counts match the report
3. Optionally look up the Base L2 transaction on a public block explorer and confirm the anchored Merkle root matches the verification page

This ties the report they are reading to attested results anchored on-chain at a specific time.

For Customers

When a SaaS vendor wants to demonstrate their security posture to a customer, they can share a verification link without sharing the full report. The customer sees:

• That a pentest was conducted, and when it completed
• The credit tier (Recon, Audit-Ready, Threat-Hunt, or Adversarial-Depth), agent hours, and tools run
• The finding counts by severity and the risk score
• That the results are blockchain-attested, with the on-chain transaction reference

This provides assurance that the vendor actually had a pentest performed without revealing potentially sensitive vulnerability details. If the customer needs more detail, they can request the full report separately - the verification link has already established its authenticity.

For Compliance Portals

Many compliance frameworks (SOC 2, ISO 27001) require evidence of regular penetration testing. Verification links can be submitted as evidence artifacts in compliance portals. The portal reviewer can visit the link to confirm the pentest attestation without the organization needing to upload sensitive report files to the compliance platform.

Verification Beyond the Link

While TurboPentest's verification page makes the process convenient, the anchor itself is public:

1. On-chain anchor - The Merkle root is readable from the Base L2 blockchain by anyone with the transaction hash
2. Attestation letter - The downloadable attestation letter records the report hash, transaction hash, block number, and chain, so the on-chain reference survives alongside the report
3. Immutability - Once anchored, no one (including TurboPentest) can alter the Merkle root

The anchored root is independent of TurboPentest's continued operation: the blockchain record of the attestation batch persists on Base regardless.

Link Expiry

Verification links expire. Links created from the attestation letter are valid for one year; explicitly created links default to 30 days and can be set up to 365 days. An expired link shows an error explaining that the pentest owner can generate a new one - expiry limits the exposure window if a link is shared more widely than intended.

The attestation itself never expires: it is immutable on-chain, and there is no mechanism to "un-attest" a pentest. A new verification link for the same attestation can be generated at any time.

Attestation History

For organizations that conduct regular pentests, TurboPentest exposes the full attestation history for an account: every pentest's attestation record, its on-chain anchor reference, and its verification links. Each completed pentest also has a downloadable attestation letter with its verification link and QR code, making it easy to hand auditors verifiable evidence for the complete history of pentests.