--- title: "Verification Links" description: "Learn how TurboPentest's verification links allow auditors and customers to independently verify pentest attestations without accessing the report contents." canonical: https://turbopentest.com/learn/reports-blockchain/verification-links source: "TurboPentest Learn" --- # Verification Links ## The Last Mile of Trust Cryptographic attestation creates a tamper-evident record of a pentest's results. But attestation is only useful if the people who need to verify it can actually do so. An auditor reviewing your SOC 2 evidence does not want to install a crypto wallet, navigate a block explorer, or compute SHA-256 hashes by hand. Verification links bridge this gap by providing a simple, shareable URL that presents the attestation and, once on-chain anchoring is live, its Base anchor. (On-chain anchoring to Base is the designed roadmap and is not yet live; what is available today is the SHA-256 report/attestation hash shown on the verification page, which anyone can check against the report. User-facing Merkle proofs are part of the same roadmap.) ## What Is a Verification Link? A verification link is a unique URL that points to TurboPentest's public verification page for a specific pentest attestation. When someone visits the link, they see: - **Engagement details** - Credit tier, risk score, agent hours, duration, tools run, and completion date - **Finding summary** - Counts of findings by severity (critical, high, medium, low, info) - **Cryptographic proof** - The attestation hash, target hash, and report hash - **On-chain anchor** - Once the attestation batch is anchored: the Merkle root, the Base L2 transaction hash (linked to a block explorer), the chain ID, and the block number - **Link expiry** - A countdown showing how long the link remains valid The verification page does not display any report contents - no finding details, no evidence, no remediation guidance. The target domain itself is shown only if the link was created with the reveal-target option enabled. An auditor can confirm that a pentest was conducted with specific attested results without seeing the findings themselves. This separation is critical - the organization controls who sees the actual report, while verification of its existence and integrity is shareable. ## Generating Verification Links Verification links are created on demand. Downloading a pentest's attestation letter automatically creates one (valid for one year, with the target revealed) and embeds it in the letter along with a QR code. Links can also be created explicitly for an attestation, with a configurable expiry (30 days by default, up to 365) and an opt-in flag controlling whether the target domain is revealed. Each verification link contains a unique token that maps to the pentest's attestation record. The token is a cryptographically random identifier - it cannot be guessed, and knowing one link does not reveal links for other pentests. The link format follows: ``` https://turbopentest.com/verify/{token} ``` The attestation record and its cryptographic hashes persist independently of any single link, so even if a link expires or TurboPentest's verification page were unavailable, the attestation can still be verified. Once on-chain anchoring is live, the anchored Merkle root will remain on Base independently as well. There is also a public verify API (`GET /api/attestations/{hash}`) that returns attestation status without authentication. ## The Verification Process When an auditor or customer visits a verification link, the system performs these steps automatically: ### Step 1: Link Resolution The token is resolved to the attestation record. If the link has expired, an error explains that the pentest owner can generate a new one. Each access updates the link's last-accessed timestamp. ### Step 2: Attestation Display The page shows the attested engagement details, the finding summary by severity, and the cryptographic hashes (attestation hash, target hash, report hash). ### Step 3: On-Chain Anchor Display If the attestation's batch has been anchored, the page shows the Merkle root, the Base L2 transaction hash linked to a block explorer, the chain ID, and the block number. Because on-chain anchoring is the designed roadmap and is not yet live (the anchoring job is intended to run as a daily batch), the on-chain section will populate once anchoring goes live; until then the page presents the cryptographic hashes (attestation, target, and report hashes) - the public verify API returns those flat hashes and a null anchor, and user-facing Merkle proofs are part of the same roadmap. ## Sharing Verification Links Verification links are designed for different audiences: ### For Auditors When an auditor requests evidence that a penetration test was conducted, you share three things: the PDF report, the report password, and the verification link. The auditor can: 1. Open the report with the password to review findings 2. Visit the verification link to confirm the attested engagement details and finding counts match the report 3. Optionally look up the Base L2 transaction on a public block explorer and confirm the anchored Merkle root matches the verification page This ties the report they are reading to attested results anchored on-chain at a specific time. ### For Customers When a SaaS vendor wants to demonstrate their security posture to a customer, they can share a verification link without sharing the full report. The customer sees: - That a pentest was conducted, and when it completed - The credit tier (display names Recon, Audit-Ready, Threat-Hunt, or Adversarial-Depth, which map to the canonical slugs recon, standard, deep, blitz used by the API and URLs), agent hours, and tools run - The finding counts by severity and the risk score - That the results are cryptographically attested (and, once on-chain anchoring is live, carry the Base transaction reference) This provides assurance that the vendor actually had a pentest performed without revealing potentially sensitive vulnerability details. If the customer needs more detail, they can request the full report separately - the verification link has already established its authenticity. ### For Compliance Portals Many compliance frameworks (SOC 2, ISO 27001) require evidence of regular penetration testing. Verification links can be submitted as evidence artifacts in compliance portals. The portal reviewer can visit the link to confirm the pentest attestation without the organization needing to upload sensitive report files to the compliance platform. ## Verification Beyond the Link While TurboPentest's verification page makes the process convenient, the attestation is designed to be independently verifiable: 1. **On-chain anchor (designed)** - Once anchoring is live, the Merkle root will be readable from the Base L2 blockchain by anyone with the transaction hash 2. **Attestation letter** - The downloadable attestation letter records the report hash (and, once anchoring is live, the transaction hash, block number, and chain), so the reference survives alongside the report 3. **Immutability** - Once anchored, no one (including TurboPentest) can alter the Merkle root The cryptographic attestation is independent of TurboPentest's continued operation: the SHA-256 report/attestation hash lets anyone re-verify the results against a copy of the report, and once on-chain anchoring is live the blockchain record of the batch will persist on Base regardless. (User-facing Merkle proofs are part of the same not-yet-live roadmap.) ## Link Expiry Verification links expire. Links created from the attestation letter are valid for one year; explicitly created links default to 30 days and can be set up to 365 days. An expired link shows an error explaining that the pentest owner can generate a new one - expiry limits the exposure window if a link is shared more widely than intended. The attestation itself never expires: its cryptographic hashes are fixed (and, once anchoring is live, immutable on-chain), and there is no mechanism to "un-attest" a pentest. A new verification link for the same attestation can be generated at any time. ## Attestation History For organizations that conduct regular pentests, TurboPentest exposes the full attestation history for an account: every pentest's attestation record, its on-chain anchor reference, and its verification links. Each completed pentest also has a downloadable attestation letter with its verification link and QR code, making it easy to hand auditors verifiable evidence for the complete history of pentests.