Applications & APIs
4 of 4 apps
Web app · tessellate.ng · criticality A
Agent banking
agents.tessellate.ng · username, password and a code by SMS · only its sign-in page answers signed out
High · on agents.tessellate.ng · 4 issues on its host
No Content-Security-Policy
Without a CSP, one injected script runs with full access to the page. On a checkout or sign-in page that's card or password theft.
What it is
Where Tessellate's agents log cash-in and cash-out for customers.
- Host
- agents.tessellate.ng
- Sign-in
- Username, password and a code by SMS
- Environment
- Production
- Owner
- Mobile
- Criticality
- Crown jewels
- Code
- No repository linkedIt runs Laravel on PHP, and none of your connected repositories are PHP. It may live in one you haven't connected.
Routes
Every route we know it answers on
Crawled, read from its scripts, seen in traffic, archived
Only its sign-in page, so far
Without a login, agents.tessellate.ng shows nothing but its sign-in page, so there’s nothing to list yet. Testing with a login, below, is how we’ll see the rest.
Behind the sign-in · coming soon
Testing what someone signed in can reach
Only the sign-in page answers without a login · the engine’s next big step
With a login, we’d test cash-in, cash-out, float top-ups and the agent's daily statement.
How it’s kept
- Encrypted with a key only your scans can use, never shown again once saved
- Used only inside your scan window, from our published addresses
- A test account you create for us, never a real merchant's or an employee's
- Delete it any time and it's gone from our side within a minute
- 00:00.0Openhttps://agents.tessellate.ng/login
- 00:01.1Typethe test agent's username
- 00:01.8Fillthe password, from your vault
- 00:09.6Readthe SMS code sent to the test number we give you
- 00:11.0Waitfor the agent's home page: we're in