LEARN
What we look for.
The failures we find most often, written out so you can read them once and never be surprised by one.
- What business logic abuse is
Business logic abuse is when someone uses your product exactly as it was built and still causes damage. Here is what it looks like, why scanners miss it, and how to go looking for it.
- Broken access control, explained
Broken access control means the app never asked whether this user should be allowed to do this. Here is how it shows up, why the interface cannot fix it, and how to hunt it down.
- IDOR and BOLA, explained
You change a number in a URL and somebody else's data comes back. That is IDOR, also called BOLA. Here is what it is, where it hides, and how to test for it in an afternoon.
- How users can run up your API bill
Someone can make your product expensive on purpose. Here are the six ways it happens, why a rate limit does not stop any of them, and what to build instead.
- What rate limits actually protect
A rate limit caps how fast one client can call something. It does not protect your budget, your data or your business rules. Here is the difference.