Hey! It’s been awhile since the last AppSec Travels blog. In this post we wanted to write about a vulnerability that is near and dear to our hearts: User Enumeration. In the world of application security, some vulnerabilities are loud and catastrophic, while others are subtle, acting as silent facilitators for more significant attacks. User…
Introduction In fields that require constant analysis, critique, and problem-solving—such as information security, auditing, and quality assurance—there’s a unique form of burnout that many professionals experience: destructive fatigue. Unlike traditional burnout, which is often tied to excessive workload, destructive fatigue stems from the mental toll of constantly tearing things down without opportunities to build. This…
During a recent assessment, our team came upon a vulnerability that felt like finding a hidden door in a seemingly secure fortress. The discovery involved the password-reset mechanism of an application, allowing us to reset any user’s password with just their email address. This flaw circumvents authentication, giving unauthorized access to user accounts. Here’s how…
Code security by coders. Manual-led application security assessments, secure-code review, and developer-friendly tooling.