Resource library
Research and practical guidance.
Learn from published security findings and guides for the applications and websites your business depends on.
Recently published
Recent research and technical guidance.
Research records the tested path and confirmed result. Guides explain the control or operating practice behind it.
NASA GLOBE Observer Stored XSS Case Study
How a mobile observation comment became stored XSS on a public NASA GLOBE web page, with verified impact, root cause, and remediation.
Read the case studyMore case files
Intigriti 0526: Unintended Stored XSS Bypass
An unintended stored XSS path in Intigriti Challenge 0526 involving unsafe innerHTML, observed SCA Shield bypass behavior, and sink-side remediation.
Read the case studyBlind Stored XSS Through a Text File Upload
How an accepted text file rendered as HTML became blind stored XSS inside an internal review workflow.
Read the case studyTechnical guides
External Attack Surface Review: What an Inventory Misses
Why an external security review must connect reachable assets to ownership, identity, configuration, and realistic attack paths instead of stopping at discovery.
Read the guideMobile API Security Testing: Where Trust Crosses the Client
Why mobile application testing must follow identity, data, and authorization decisions from the device into the APIs and services behind it.
Read the guideWhat to Expect in an Application Security Report
How a useful application security report connects scope, evidence, impact, severity, remediation, and retest status for both decision makers and engineers.
Read the guideReading paths
Browse by role and work type.
Bug-hunting methods, authorization, identity, API behavior, and evidence practices for people responsible for web and application risk.
Operational resilienceSmall-Business SecurityPractical controls for website ownership, website repair, monthly care, impersonation, ransomware exposure, and the systems small organizations rely on every day.
Application security
Have a specific application, API, or external surface to assess?
Security testing
Share what you need help with and your timeline. I’ll reply directly about the work, availability, and next steps.