Skip to content
Fast-turnaround security assessments available — 10+ years development & security experienceGet started
Cases

Security Cases

Real-world vulnerability research and attack chain walkthroughs. See how single misconfigurations cascade into critical compromises.

Business LogicCVSS 7.8high
9 min read

The Silent Seat That Disappeared

During a security assessment of an election management platform, a business logic error in the seat allocation algorithm caused one legislative seat to silently disappear under specific vote distribution conditions. No error was thrown. No warning was logged. The software produced a result, and the result was wrong.

Read case
OtherCVSS 8.2high
9 min read

Five Subdomains, Five Takeovers, One Afternoon

DNS enumeration against a media infrastructure company turned up not one dangling CloudFront record but five. Each subdomain pointed to a deleted CloudFront distribution. Each was claimable. By the end of the afternoon, five proof-of-concept pages were live under the company's own domain.

Read case
Info DisclosureCVSS 7.5high
7 min read

Kubernetes Blueprints Left on the Doorstep

During an assessment of a media streaming company's infrastructure, an ArgoCD instance was reachable over the public internet with no authentication required. Its API exposed the full inventory of Kubernetes applications, source repository paths, cluster connection details, and deployment configuration — the architectural blueprint of the organization's production environment.

Read case
Access ControlCVSS 8.8critical
8 min read

The iframe That Could Rewrite Ballot Templates

A government digital services platform trusted every postMessage it received — no origin check, no source validation. Any website could embed the platform in an iframe and send crafted messages to modify sensitive document templates. One missing conditional turned a routine message handler into an access control bypass.

Read case
OtherCVSS 8.5high
7 min read

Searching for Every Voter With a Single Percent Sign

A search field on a civic technology platform accepted SQL LIKE wildcards without sanitization. Entering a single percent sign returned the entire database — every record, every row, no authentication escalation required. Just one character in a search box.

Read case
OtherCVSS 7.5high
7 min read

The Subdomain Someone Else Already Owned

A routine DNS enumeration uncovered a subdomain pointing to a cloud resource that no longer existed. The CNAME was still live, the cloud resource was available for anyone to claim, and the subdomain was one registration away from serving attacker-controlled content under the company's domain.

Read case
Info DisclosureCVSS 8.2high
9 min read

652 Repositories, Zero Authentication

An exposed container registry at a global infrastructure provider held 652 repositories with no authentication. Docker image layers contained full application source code, configuration files, API keys, database credentials, and internal service architecture maps. This is the story of how it was found and what it revealed.

Read case
Auth BypassCVSS 9.0critical
8 min read

The Login Link That Let Anyone In

The platform sent login links by email. Each link contained a token. The problem was the application accepted that token from the URL and bound it to whoever authenticated next — which meant an attacker who knew the token could wait for any user to log in and immediately inherit their session.

Read case
OtherCVSS 9.1critical
9 min read

When Mock Cryptography Ships to Production

A government digital platform handling citizen votes went live with placeholder cryptographic functions that returned hardcoded values and used trivially breakable algorithms. The mock code was never replaced. Every signature could be forged, every encrypted payload could be read in plaintext, and the integrity guarantees the system promised existed only on paper.

Read case
Otherinformational
8 min read

What Goes Into a Security Assessment: From Reconnaissance to Remediation

A detailed look at how we conduct security assessments — from initial reconnaissance through manual exploitation to delivering actionable remediation reports.

Read case
Auth BypassCVSS 9.1critical
4 min read

The Trusted Email That Wasn't

A legitimate password reset email — SPF passed, DKIM valid, sender verified. But the link inside pointed to an attacker's domain. One HTTP header turned a routine email into a full account takeover.

Read case
IDORCVSS 9.3critical
5 min read

Half a Billion Profiles Behind a User-Agent String

A major platform's API returned full user profiles to anyone who asked. The only barrier was a WAF that ignored mobile traffic. One header change, hundreds of millions of accounts exposed.

Read case
Auth BypassCVSS 8.6high
5 min read

The Trailing Slash That Bypassed Authentication

Adding a single character to the end of a URL turned a 401 into a 200. Not on one endpoint — on thirty, across ten microservices. One slash, an entire backend unlocked.

Read case