Research
Some of the most dangerous vulnerabilities don't originate from traditional attack vectors — they emerge from subtle architectural decisions in how user sessions are managed. In this write-up, we detail a critical vulnerability our team discovered in a cloud-based employee monitoring platform during a bug bounty engagement,
product
Organizations today have large and constantly changing attack surfaces. New web servers, SSL certificates, and subdomains are created frequently. Traditional, point-in-time assessments often miss these changes because they happen so quickly. A common issue with Attack Surface Management (ASM) tools is that they generate too much unorganized data.
Research
OAuth 2.0 is the backbone of modern authentication. When an identity provider gets it wrong, the blast radius can be enormous. In this write-up, we detail a vulnerability we discovered in a major multi-tenant identity governance platform during a bug bounty engagement, where a flaw in the
product
Nobody's infrastructure stands still anymore. A developer spins up a staging server for a demo. Another team ships a new microservice on Friday. Someone wires in a third-party API and moves on. None of this goes through security review — and honestly, it shouldn't have to.
product
Securing web applications requires deep scanning that understands how the application works. Snapsec's Web Application Scanner (WAS) provides this by using automated discovery, crawling, and vulnerability detection to secure your web assets. Here is a look at how Snapsec WAS helps security teams find and fix application vulnerabilities.
Research
Modern enterprise applications often consist of dozens of interconnected services, development environments, and staging servers. When these non-production environments are exposed to the internet, they can become a silent liability. In this write-up, we detail how our Continuous Attack Surface Management (CASM) product discovered an exposed staging environment