Features
SSRF assessment: validate outbound trust boundaries safely
An SSRF assessment should identify which user-influenced actions cause a server to make an outbound request, then evaluate the intended destination policy with ...
3 min read
Category
Features
Practical security guides, enterprise buying advice, and product comparisons.
Features
Presigned URL review: who can receive a storage capability?
A presigned URL security review should examine both the storage permission and the application decision to issue the link. A correctly signed download can still...
3 min read
Features
AI Agent Audit Logs: Record Actions Without Collecting Secrets
Design assessment evidence that connects a user request to tool authorization and outcome while minimizing sensitive trace content....
3 min read
Features
Authenticated Pentesting: Build a Role and Tenant Coverage Matrix
Use a role-by-action matrix to plan authenticated application testing and identify what was observed, blocked, or left untested....
3 min read
Features
Browser Agent Sessions: Keep Workspaces and Accounts Separate
Review browser-profile isolation, downloads, account switching, shared workers, and cleanup for AI agents operating authenticated applications....
3 min read
Features
RAG Citation Provenance: Verify What the Answer Actually Used
Assess citation integrity, source permissions, document versions, and claim support in retrieval-augmented answers....
3 min read
Features
WAF Allowlisting During a Pentest: Record the Coverage Tradeoff
Decide whether test traffic should pass through normal protective controls or use a documented exception, based on the assessment objective....
3 min read
Features
Production or Staging Pentest: What the Evidence Can Support
Compare environment fidelity, safety, identity, integrations, and deployment differences before deciding where a pentest should run....
3 min read
Features
PTaaS SLA Questions: Timing, Access, Retesting, and Escalation
Review a penetration-testing service SLA by its start conditions, delivery commitments, blockers, retest terms, and escalation process....
3 min read
Features
Invitation flow security: ownership, expiry, and role assignment
An invitation-flow security review should examine who may invite, which identity may accept, and what permission the accepted invitation grants. These decisions...
3 min read
Features
AI Agent Memory Poisoning: Assess Persistence Across Sessions
Test memory write authority, provenance, isolation, and reset behavior using harmless persistent markers and controlled agent tasks....
3 min read
Features
AI Agent Transactions: Test Identity, Tools and Authority
Test the authority behind an AI agent’s business actions using controlled identities, mock tools and explicit authorization....
3 min read