Findings and methods from real testing. Access control, APIs, GraphQL, authentication, business logic and AI application security, written so an engineer can act on them.
19 articles8 topicsUpdated 16 October 2026
19 articles
Prompt injection gets the headlines, but the real AI security gap in SaaS is access control. How AI agents break authorization, cause BOLA and BFLA at the tool layer, leak tenant data, and how to test it manually.
Prompt injection gets the headlines, but the real AI security gap in SaaS is access control. How AI agents break authorization, cause BOLA and BFLA at the tool layer, leak tenant data, and how to test it manually.
PractitionerMost developers meet JSON Web Tokens the same way. A library hands you a token, you store it, you send it back on every request, and the framework tells you whether the user is logged in. It works, so nobody looks inside. I look inside for a living, and tokens are one of the places…
PractitionerMost teams ask this question with a budget in front of them and room for one. The honest answer is that a source code review and a penetration test answer different questions, and the right choice depends entirely on which question is currently costing you. A penetration test tells you what an attacker can do…
PractitionerA vulnerability assessment is a structured review of an application, its APIs and its exposed infrastructure that identifies security weaknesses, confirms which of them are real, and rates each one by the risk it presents to the business. It answers a narrow question well: what is currently wrong, where, and how serious is it. That…
PractitionerA standard tells you what to test. It does not tell you where your product breaks. This is what PTES, OWASP WSTG, the OWASP API Security Top 10, OWASP ASVS and NIST SP 800-115 actually cover, which parts matter when the target is a SaaS application or an API, and which parts exist mainly so…
Deep diveFor years, application security teams have asked a familiar question: What can this user access? That question still matters. But as AI agents become integrated into SaaS platforms, companies increasingly need to ask another one: What can this AI agent access, and what can it do with that access? That distinction is becoming important. AI…
PractitionerModern SaaS applications are built around business processes rather than simple web pages. Users create projects, invite teammates, purchase subscriptions, approve invoices, generate reports, and collaborate across organizations. Every one of these actions follows a set of business rules that determine what should and should not happen. Most security discussions focus on familiar vulnerabilities like…
Deep diveLearn how modern SaaS teams evaluate authorization, role boundaries, tenant isolation, object ownership, and business logic to identify security weaknesses before they become production incidents. Modern SaaS applications are designed to handle some of an organization’s most valuable assets. Customer records, invoices, source code, financial information, healthcare data, internal documentation, AI workflows, and administrative controls…
FundamentalsUnderstanding one of the most common and dangerous security flaws affecting modern SaaS applications. Modern SaaS applications are built around one simple idea: users should only be able to access the data and functionality they are authorized to use. Customers trust these platforms with invoices, customer records, financial information, source code, medical records, and countless…
PractitionerMost organizations spend a significant amount of time thinking about authentication. They implement strong password policies, enable multi-factor authentication, and invest in secure login systems. These are important controls and should never be ignored. However, many of the most damaging security incidents do not happen because an attacker bypasses authentication. They happen because the attacker…
PractitionerGraphQL has become one of the most popular technologies for building modern APIs. Many SaaS companies adopt GraphQL because it gives developers greater flexibility, reduces over-fetching, and allows applications to retrieve exactly the data they need through a single endpoint. For engineering teams, this often results in faster development cycles and a more efficient frontend…
PractitionerAuthentication is one of the most important security controls in any SaaS application. It verifies that a user is who they claim to be, and establishes the identity that every later access decision depends on. Every login page, mobile application, API, and third-party integration ultimately relies on authentication to establish trust between users and the…
FundamentalsMost companies think the penetration test is the final deliverable. It’s not. The real value often comes after the testing is complete: inside the penetration test report itself. Because a good penetration test report does more than list vulnerabilities. It explains how your application can actually be attacked, what business risk exists, how the issue…
FundamentalsArtificial intelligence is quickly becoming a core part of modern applications. From chatbots and recommendation systems to internal automation tools and AI-powered workflows, SaaS platforms are integrating AI at an increasing pace. But while AI is improving efficiency and user experience, it is also introducing something most teams are not fully prepared for. New attack…
FundamentalsIf you’re building a SaaS product or managing a web application, you’ve probably come across both terms: penetration testing and vulnerability scanning. They’re often used interchangeably, but in reality, they solve very different problems. Understanding that difference is critical, because choosing the wrong approach can leave real vulnerabilities completely unnoticed. What Vulnerability Scanning Does Vulnerability…
PractitionerAPIs are the backbone of modern SaaS applications. Every login, dashboard update, integration, or workflow is powered by API calls running in the background. But here’s the problem. Most SaaS companies focus heavily on the frontend and assume the backend APIs are “safe by default.” They’re not. In real-world security testing, APIs are often the…
FundamentalsIntroduction Most SaaS companies believe they are secure. They rely on cloud infrastructure, managed services, and modern frameworks. On the surface, everything looks solid. But in reality, most breaches today don’t come from complex exploits or zero-days. They happen because of something much simpler: Access. Trust. And broken logic. In many cases, attackers don’t “hack”…
FundamentalsIf you have come across The Hidden Finds and are wondering what it actually is, this article is for you. In simple words, The Hidden Finds is a cybersecurity company that helps businesses find security weaknesses before attackers do. I work with modern companies, especially SaaS platforms and online businesses, to improve their security through…
PractitionerExposed asset detection is the process of finding every system your organization has reachable from the public internet, including the ones nobody remembers creating. It is the first step in any serious security programme, because every control you buy afterwards quietly assumes you already know what you are protecting. Most organizations do not. The inventory…
No articles match that search. Try a broader term, or .
Four articles that build on each other, from what the flaw is through to how to test for it. Read them in this order if the subject is new to you.
Explore new security research, attack-path analysis, and practical SaaS security insights.
