Case studies
An account that should see nothing got client data from eight endpoints
Wealth management: an account with no rights got client data from eight endpoints. The worst returned hundreds of records and…
09
Blog
Technical insights, QA methodologies, and software testing strategies from our engineering team.
Latest articles
10
Case studies
A bad request came back as 'success', in four subsystems of a wealth platform
Wealth platform: bad requests got 200 and success, so callers could think they had worked. The same failure turned up…
11
Best Practices: Insights & Perspective
We told the model the rule. It broke the rule in about one draft in twelve to twenty.
A banned phrase appeared in about one AI email in twelve to twenty, with no production check. Why a prompt…
12
Case studies
A cleanup button would have deleted three quarters of a photo library, and no photo was broken
A car-services photo gallery's cleanup button judged photos broken by a missing thumbnail. Three in four rows would have gone.
13
Case studies
Absent 11 days, charged for 10: when one leave rule lives in twelve places
One holiday rule lived in twelve places and gave two answers across leave, overtime and a public page. How we…
14
Case studies
Two weak points in a business app chain into account takeover, while tenant isolation held
In a multi-tenant business app tenant isolation held, but no rate limit and wildcard CORS chain into takeover. 13 findings,…
15
Case studies
One loose setting opened the admin side of a property marketplace before launch
A pre-launch review found one chain exposing the admin surface. One change closed it, and the report names what we…
16
Case studies
A captured request could be replayed against any endpoint of a care-sector app
A care app signed requests but not the URL or body. Four critical findings in one day, and a fix…
17
Case studies
Is your health app's source code public? A review found 15 source maps anyone could read
Security review of a clinical app: 15 public source maps, no critical flaw, five attack classes ruled out, one false…