App Security

Configure TLS 1.3 cipher suites and key groups and check them with testssl.sh

Scan repos, CI pipelines and git history for leaked AWS keys with TruffleHog

Test APIs for excessive data exposure and mass assignment on object properties

Prevent dependency confusion in npm, PyPI and Maven by pinning trusted package sources

Vet npm packages for install-script malware and exfiltration using GuardDog

Find undocumented API endpoints through gateway traffic, cloud configs and code mining

Audit GitHub Actions workflows for unpinned actions, script injection and secret leaks

Flag typosquatted npm, PyPI and crates.io packages before you install them

Score npm and PyPI names by similarity, new publish dates and download anomalies

Test API parameters and request bodies for SQL, NoSQL, LDAP injection and SSRF

Reach admin API endpoints with low-privilege accounts by switching methods and paths

Compare raw API responses with UI output to find leaked PII and internal fields

Find IDOR flaws by swapping object IDs across sessions with Burp Suite

Find insecure deserialization in Java, PHP, Python and .NET apps to get code execution

Test JWT algorithm confusion, alg none and kid injection to bypass auth checks

Inject hidden fields like isAdmin into REST API requests to test mass assignment

Test MongoDB and CouchDB apps for NoSQL injection that bypasses login or leaks data

Find OAuth and OIDC flaws in redirect URIs, token leakage and code theft

Find prototype pollution in client and Node.js code that leads to XSS or RCE

Test race conditions with Burp Turbo Intruder single-packet attacks on rate limits

Reach cloud metadata and internal services through SSRF during authorized pentests

Find and exploit SQL injection with manual payloads and sqlmap in authorized pentests

Run sqlmap to confirm SQL injection and pull database contents in authorized tests

Find server-side template injection in Jinja2, Twig and Freemarker that reaches RCE

Bypass PHP login checks with loose comparison and magic hash type juggling

Test WebSockets for auth bypass, cross-site hijacking and injection flaws

Generate CycloneDX and SPDX SBOMs with Syft, scan them with Grype and sign with Cosign

Encrypt data at rest with AES-256-GCM, key derivation and nonce management

Detect API abuse with Redis rate limits that tighten during attacks

Enforce auth, throttling, request validation and TLS at Kong, AWS or Apigee gateways

Generate, hash and rotate API keys with scoping and automated leak monitoring

Set per-user and per-endpoint API rate limits with Redis and proper 429 responses

Validate API requests against OpenAPI and JSON Schema to reject unknown fields

Discover and risk-score internal, partner and shadow APIs in one unified view

Audit OpenAPI files and scan APIs with 42Crunch in CI/CD and IDEs

Block malicious API payloads and clients with Apigee threat protection and SpikeArrest

Scan container images with Trivy for CVEs, misconfigs and secrets in CI and registries

Tune AWS WAF, Azure WAF and Cloudflare rules to block injection and bad bots

Sign build artifacts with GPG and Sigstore and verify signatures in deploy pipelines

Add Semgrep, Trivy, OWASP ZAP and Gitleaks scans to CI/CD pipelines

Sign and verify messages with Ed25519 keys and compare them with RSA and ECDSA

Publish SPF, DKIM and DMARC records to stop domain spoofing and enforce quarantine

Build Signal-style end-to-end encryption with key exchange and forward secrecy

Rank CVE backlogs by EPSS exploitation probability scores from the FIRST API

Turn on GitHub code scanning with CodeQL, secret scanning and Dependabot alerts

Build a FIDO2 and WebAuthn server with YubiKey enrollment and passkey workflows

Issue short-lived database, AWS and PKI credentials from Vault dynamic secret engines

Sign container images with Cosign and enforce signature checks at Kubernetes admission

Sign and verify JWTs with ES256 or EdDSA and block algorithm confusion attacks