Hands-on vulnerability writeups, bug bounty findings, and field notes from our security research team.
Annual VAPT, cyber audit, and whether a CERT-In empanelled auditor is mandatory — a plain guide to the CSCRF obligations for mid-size, small and self-certification regulated entities.
Data-flow mapping, consent, security safeguards, Data Principal rights and breach response — a plain-language checklist to find your DPDPA gaps before enforcement bites.
A walkthrough of an account-takeover flaw in a password reset flow, where insufficient validation of user parameters let an attacker pivot the verification email to seize other accounts.
A critical 2FA flaw discovered in the wild, where manipulating the username parameter during OTP verification let an attacker bypass two-factor and take over arbitrary accounts.
A misconfigured API endpoint on a job application platform exposed an entire AWS S3 bucket — 453 unprotected resumes accessible without auth. A clean lesson in why cloud access control reviews matter.
A live financial site let an attacker bypass 2FA by tampering with the OTP-verify response payload, then register accounts under arbitrary phone numbers. Classic response manipulation, real impact.
The findings on these posts are the kind of work we do for clients every day. Browse our 10 services or see fixed-price packages.