OID-See v1.1.0 Live: Risk Assessment with Context

We launched 𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗗𝗲𝗲𝗽 𝗦𝗰𝗮𝗻, our next-generation vulnerability scanner for 𝘄𝗲𝗯, 𝗔𝗣𝗜𝘀, 𝗮𝗻𝗱 𝗺𝗼𝗯𝗶𝗹𝗲 𝗮𝗽𝗽𝘀 (𝗶𝗢𝗦, 𝗔𝗻𝗱𝗿𝗼𝗶𝗱, 𝘀𝗼𝗼𝗻 𝗛𝗮𝗿𝗺𝗼𝗻𝘆𝗢𝗦). We are 𝘁𝗵𝗲 𝗳𝗶𝗿𝘀𝘁 𝗮𝗻𝗱 𝗼𝗻𝗹𝘆 𝗽𝗹𝗮𝘁𝗳𝗼𝗿𝗺 𝗱𝗲𝗹𝗶𝘃𝗲𝗿𝗶𝗻𝗴 𝗱𝗲𝗲𝗽 𝗮𝗴𝗲𝗻𝘁𝗶𝗰 𝘀𝗰𝗮𝗻𝗻𝗶𝗻𝗴 𝗳𝗼𝗿 𝗺𝗼𝗯𝗶𝗹𝗲, with full coverage for web and APIs, going beyond standard scanning to give security teams more confidence and control. Agentic Deep Scan uncovers logic flaws in authentication, onboarding, payments, and account workflows, to runtime tampering, API abuse, broken authorization patterns (BOLA, BFLA, IDOR-style), and cross-component attack chains. It can be customized to focus on individual risks, 𝗮𝗰𝗰𝗲𝘀𝘀 𝘂𝘀𝗶𝗻𝗴 𝘆𝗼𝘂𝗿 𝗼𝘄𝗻 𝗔𝗜 𝗔𝗣𝗜 𝗸𝗲𝘆 (𝗕𝗬𝗢𝗞) and given extra context like documentation and source code to improve its testing. How it works: •𝗔𝗱𝗱 𝗬𝗼𝘂𝗿 𝗔𝗜 𝗣𝗿𝗼𝘃𝗶𝗱𝗲𝗿 𝗞𝗲𝘆 (𝗕𝗬𝗢𝗞), connect your credentials so usage and spend align with internal policies •𝗥𝘂𝗻 𝗔𝗴𝗲𝗻𝘁𝗶𝗰 𝗗𝗲𝗲𝗽 𝗦𝗰𝗮𝗻 𝗼𝗻 𝗪𝗲𝗯, 𝗔𝗣𝗜, 𝗼𝗿 𝗠𝗼𝗯𝗶𝗹𝗲 𝗧𝗮𝗿𝗴𝗲𝘁𝘀, explore runtime behavior, workflow logic, authorization paths, and cross-component attack chains •𝗥𝗲𝗰𝗲𝗶𝘃𝗲 𝗘𝘅𝗽𝗹𝗼𝗶𝘁𝗮𝗯𝗶𝗹𝗶𝘁𝘆-𝗙𝗶𝗿𝘀𝘁 𝗢𝘂𝘁𝗽𝘂𝘁, validated findings with proof-grade evidence for confident triage •𝗥𝗲𝘁𝗲𝘀𝘁 𝘁𝗼 𝗩𝗲𝗿𝗶𝗳𝘆 𝗙𝗶𝘅𝗲𝘀, confirm that remediation resolves the underlying issue and reduces risk. A real vulnerability example is shared in the first comment. Learn more ↓ 𝗪𝗲𝗯: https://lnkd.in/egVJWqMB 𝗠𝗼𝗯𝗶𝗹𝗲: https://lnkd.in/eUqeGndk

"Where do you store auth tokens?" Keychain. Confident. Correct. My interviewer nodded. Then kept going. "What happens to the token after you read it out of Keychain?" I didn't have a clean answer. Here's what I figured out after that interview. Keychain secures the token while it's sitting still. But a token doesn't sit still you read it, pass it into headers, hold it across sessions, and discard it. Each of those steps is a place it can land somewhere unintended. Four places it actually happens in real codebases: 1. Singleton token read once at login, parked in AuthManager.shared for the entire session. On a jailbroken device with a memory inspection tool, that's an open read. 2. App switcher iOS captures a screenshot the moment your app backgrounds. If something sensitive is on screen, that data is now an unencrypted file on disk. Two lines in sceneWillResignActive closes this completely. 3. Crash logs token was a local variable when the crash happened? It may be sitting in your Sentry dashboard right now, uploaded automatically. 4. Keychain flag "kSecAttrAccessibleAlways" makes the token readable even when the device is locked. One wrong attribute, the whole protection level drops. Keychain is the right call. But storage is just one moment. The real question is what your code is doing at every other moment. Full breakdown with code link in the first comment.

https://lnkd.in/e7Hc6gca Most frontend security is still handled after the UI is built. Sanitisation, validation, edge-case handling… all layered on top of components that were never designed with security in mind. I’ve been working on a different approach: → UI components with security built in by default → Safer input handling at the component level → Optional telemetry to surface misuse and edge cases The goal is simple: Reduce the gap between “working UI” and “secure UI”. Just released an early version of the landing page: https://lnkd.in/e7Hc6gca Would be interested in feedback from: frontend developers security engineers anyone building production UIs Especially around: API design real-world use cases where this actually adds value (or doesn’t) This space feels underexplored. Curious to see where it goes.

🗣️ SPEC ID IS BETTER DEVICE ID Device ID was built for a world where identity lived inside the browser. If JavaScript ran and signals were available, you could link sessions together and approximate a user. That model breaks the moment the browser stops cooperating. 💡 Spec ID doesn’t depend on the browser at all. More importantly, it changes what identity means. Instead of tying activity to a device, Spec ID ties activity to an actor. ➡️ Events that look unrelated start connecting ➡️ Reconnaissance links to execution ➡️ Signup, login, and transaction behavior collapse into a single journey What looked like thousands of users resolves into one coordinated system. It's the identity layer that allows you to see how attacks actually operate. Once you can see the full journey, everything downstream gets better: 🛡️ Detection becomes more precise 📈 Models get cleaner data 👇🏼 False positives go down 👤 Real users experience less friction Most systems are still evaluating moments while attackers are operating across time. Spec ID connects the two. Get the full breakdown →

𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗦𝘆𝘀𝘁𝗲𝗺, 𝗣𝗿𝗼𝗷𝗲𝗰𝘁 𝗥𝗲𝗽𝗼𝗿𝘁 This project presents a full-stack authentication system designed to handle how users securely create accounts, verify their identity, and access a platform. It mirrors the kind of login experience commonly found in modern applications, with a strong focus on security, usability, and real-world relevance. At its core, the system enables users to sign up, receive a verification code (OTP), and confirm their account before gaining access. Once verified, users can log in securely, while also having the option to reset their password if needed. Each step is carefully structured to ensure data protection and a smooth user experience. From a technical perspective, the application is built using a frontend interface that manages user interaction and a backend server that handles authentication logic and data processing. Sensitive information such as passwords is encrypted, and secure tokens are used to manage user sessions, ensuring that access remains protected at all times. Overall, this project demonstrates the ability to design and implement a complete, secure authentication workflow similar to what is used in real-world products. It highlights practical knowledge of building scalable systems while maintaining clean user experience and strong security standards. https://lnkd.in/dbPvNAuz #WebDevelopment #FullStack #ReactJS #NodeJS #Authentication #TechProjects #SoftwareEngineering #BuildInPublic #Developers #Frontend #Backend #CodingJourney #TechCareers

Today’s session by Hitesh Choudhary and @piyushgarg_dev was packed with real-world backend concepts We continued with Building RESTful APIs (Part 2) and dived deep into: • Authentication & JWT basics • Access Tokens vs Refresh Tokens • How JWT enables secure sessions • Authorization — controlling who can access what • Security trade-offs in real applications Highlight of the day: Got the chance to be in the hot seat and discuss real auth flows like: → /forgot-password → /new-password Understanding how these flows actually work behind the scenes — from token generation to secure password reset — made everything click. Big takeaway: Auth is not just a feature, it's a core system design problem that directly impacts security and user experience. #BackendDevelopment #RESTAPI #JWT #Authentication #Authorization #WebDevelopment #LearningInPublic #chaicode

March was a busy month: $𝟒,𝟓𝟎𝟎 in bounties, mostly centered on Access Control flaws. One thing I see constantly: researchers getting stopped by UI protections. If you’re only testing what the interface allows, you’re missing the real story. Backend engineers often assume that if a user can't see an API call, they won't try to manipulate it. 🐞I recently documented a case where a "simple" $𝟱𝟬𝟬 𝑬𝒎𝒂𝒊𝒍 𝑽𝒆𝒓𝒊𝒇𝒊𝒄𝒂𝒕𝒊𝒐𝒏 𝒃𝒚𝒑𝒂𝒔𝒔 escalated into a $𝟭,𝟱𝟬𝟬 payout. By treating that bypass as a catalyst rather than a final result, I was able to chain it into a full account takeover. Don’t stop at the UI. 𝗧𝗵𝗲 𝗿𝗲𝗮𝗹 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗮𝗿𝗲 𝘂𝘀𝘂𝗮𝗹𝗹𝘆 𝗵𝗶𝗱𝗶𝗻𝗴 𝗶𝗻 𝘁𝗵𝗲 𝗔𝗣𝗜 𝗹𝗼𝗴𝗶𝗰. 🔗Full write-up here: https://lnkd.in/dU8P-RXJ

Safe{Research} spotlight 🔬 Blind signing. Spoofed interfaces. Social engineering. Most wallet security failures happen at the UI layer. You trust what you see on screen, and attackers exploit that. What if the security guarantees didn't depend on the interface at all? Our manifesto for the next generation of self-custody 👇 https://lnkd.in/dm6FrMxS

How XDRInternals Weaponizes MFA: From Live Response to Full Interactive Shell Without a Browser + Video Introduction: Modern Extended Detection and Response (XDR) platforms are designed to give defenders visibility, but a new wave of tooling is flipping the script for penetration testers and red teamers. By leveraging contributions from security researchers like Alex Kefallonitis, tools such as XDRInternals are now capable of transforming a simple live response session into a fully interactive shell, all while bypassing traditional Multi-Factor Authentication (MFA) hurdles like push notifications and OTP codes without ever opening a browser....

OpenClaw (Tailscale path), Concurrent async auth race condition, CVE-2026-32041 (Low severity) The vulnerability arises from how OpenClaw's Gateway handles concurrent asynchronous shared‑secret authentication attempts on routes that are Tailscale‑capable. On the async Tailscale Serve Control UI path, when multiple authentication requests for the same {scope, ip} arrive simultaneously, they are serialized before the failed‑auth rate limiter records a failure. This means that the first request is processed, fails, and is recorded against the rate‑limit budget....