Penetration testing found a flaw