The worm in your dependencies
A self-spreading worm rode npm install hooks into hundreds of packages. Your build ran their code before your app did. Here is what we check.
Articles
Articles
What we look for, and how we prove it.
The access control a scanner cannot see
Broken access control is the single most exploited class of web flaw, and it is invisible to a tool with one login. The test is one account reaching for another's data.
When the password is already stolen
Most attacks on web apps start with a valid password from someone else's breach. The defence is not a stronger login form, it is what happens after the tenth guess.