Research
Application & API Security Research
We study recurring flaws in web applications and APIs, rather than assessing one client's deployment.
The work
What this actually involves
The target determines which methods matter.
-
Authorisation as a class
Study how frameworks enable broken object-level access control.
-
Authentication and sessions
Find failures in issuing, renewing, expiring, and revoking sessions.
-
Logic and state machines
Find flaws in the order of otherwise valid actions.
-
Parsers and protocol edges
Investigate parsing mismatches, request smuggling, and deserialisation.
-
Client-side boundaries
Test assumptions about browser and application security boundaries.
-
AI-backed features
Study failures where models use tools, memory, and untrusted text.
Next
How it runs, and how to commission it
Every project follows the same process and disclosure terms.
Ask about application & api research
Tell us what the target is and what you need to know about it.