Research
Application & API Security Research
The web is where most software meets most people, and where the same few mistakes are made in each new framework. We study the classes of flaw and where they come from, not one client's application.
The work
What this actually involves
Not a checklist worked through in order. These are the parts of the job, and the target decides how much of each it needs.
-
Authorisation as a class
Broken object-level authorisation is not one bug, it is a shape. The question is which frameworks make that shape easy to draw by accident.
-
Authentication and sessions
Issue, renew, expire, revoke. Four verbs, and the interesting failures live between them.
-
Logic and state machines
Applications correct on every step and wrong about the order. No scanner has a signature for that.
-
Parsers and protocol edges
Two components that agree on a format and disagree about one byte of it. Request smuggling and deserialisation live here.
-
Client-side boundaries
What the browser enforces, and what the application only believes it enforces. The gap is where the origin model gets interesting.
-
AI-backed features
Models handed tools, memory and somebody else's text. A new surface failing in some very old ways, and the area moving fastest.
Next
How it runs, and how to commission it
Every piece of research follows the same four steps, and the same terms apply to what comes out.
Ask about application & api research
Tell us what the target is and what you need to know about it.