Engineering guidance
Application Security
These guides cover identity, authorization, API behavior, and reporting. They help engineers separate confirmed behavior from automated signals that still need validation.
6 published guides
Browse all articlesReading list
Guides for your next decision.
Start with the featured guide or choose the question that matches your work.
What to Expect in an Application Security Report
How a useful application security report connects scope, evidence, impact, severity, remediation, and retest status for both decision makers and engineers.
Read the guideRemediation Verification: What a Security Retest Confirms
How a focused security retest distinguishes a fixed issue from a blocked proof, partial remediation, adjacent bypass, or changed environment.
Read the guideManual Bug Hunting With Reproducible Validation
How disciplined bug hunting moves from reconnaissance to a manually reproduced, evidence-backed vulnerability report.
Read the guideAPI Security Testing for Real Attack Paths
How manual API testing finds authorization, authentication, data exposure, workflow abuse, and endpoint inventory gaps.
Read the guidePassword Security Is a Trust Boundary Problem
Passwords are only one part of account security. Recovery, MFA, sessions, and authorization define the trust boundaries attackers test.
Read the guideApplication security review
Need a closer look at an application path?
Security testing
Bring the roles, workflows, API surface, and concern. Garrett will turn them into a focused, authorized application-security review.