Insights

HTTP Request Smuggling (HRS) is a web security vulnerability that is often missed during security testing because it targets the way different servers process HTTP requests. It occurs when a front-end server and a back-end server interpret the same request differently, allowing an attacker to manipulate the request flow. Depending on the setup, this can […]

Imagine clicking: Continue with Google You expect one thing to happen: Google confirms who you are, and the website lets you in. Simple, right? Behind that innocent-looking button, however, is a chain of redirects, authorization codes, tokens, browser sessions, identity providers, and application logic. And if even one part of that chain is implemented incorrectly, […]

What Is an Electron-Based Desktop Application? Electron-based desktop applications are desktop apps that are built using web technologies like HTML, CSS, and JavaScript instead of traditional programming languages such as C++ or Java. A website normally runs inside your browser (Chrome, Edge, Firefox). An Electron app takes that website and packages it as a desktop […]

Introduction If you’ve ever read about a company exposing customer data, there’s a good chance an access control issue was one of the reasons. One of the most common causes is Insecure Direct Object Reference (IDOR). Even though it has been known for years, it is still one of the most common vulnerabilities found in […]

Recovering stored credentials should be hard. On a recent engagement, it was not. Some of the systems we test look like they do everything right. This one passed every surface check. Then it handed over all of its stored credentials the moment someone looked past the label. A system built with the right tools gives […]

Artificial intelligence is growing and evolving faster than ever. A few years ago, AI was limited to simple chatbots: you asked a question, the chatbot provided an answer, and the conversation ended there. These traditional chatbots had security flaws like prompt injection, but the impact was usually limited to unexpected responses, nothing like the AI […]

As AI assistants become more capable, they’re no longer just answering questions, they’re interacting with real systems that store real data. Large Language Models (LLMs) are really good at understanding and generating text, but on their own, they can’t interact with the outside world. They can’t open files, access databases, or use an application unless […]