Research & advisories
Technical write-ups from the TrekShield bench, and the place we publish security advisories for vulnerabilities we find in third-party software.
Technical notes
How real attacks on access control and business logic work, and how we prove them.
- APIAccess ControlOWASP
BOLA vs. BFLA: the two API authorization failures that matter most
Broken object-level and broken function-level authorization top the OWASP API Security list for a reason. Here's the difference, why both are missed, and how to test for each.
March 20, 2026 · 7 min read Read the write-up - ReportingMethodology
What a good penetration test report actually contains
The report is the product. Here's what separates one your engineers act on from one that gets filed and forgotten — section by section.
February 24, 2026 · 8 min read Read the write-up - WebBusiness LogicMethodology
Business logic flaws: the bugs scanners can't see
The highest-impact vulnerabilities rarely look like vulnerabilities. They're valid requests that do something the business never intended — and only a human can spot them.
February 2, 2026 · 7 min read Read the write-up - WebAPIAccess Control
Finding IDOR in multi-tenant SaaS
Broken object-level authorization is the flaw scanners miss most. Here is how tenant-isolation bugs actually happen, and how we prove real impact by hand.
January 14, 2026 · 8 min read Read the write-up
How we handle vulnerabilities we find
Every advisory we publish is a complete public record, so you can judge the risk and act on it without asking us anything. Each one states:
- The affected vendor, product and versions
- The fix, or a plain statement that none existed at disclosure
- The CVSS v3.1 score and the full vector it was computed from
- The weakness class (CWE)
- A dated disclosure timeline
- Credit to the researchers, only with their consent
Found a vulnerability in TrekShield?
That is a different process. Email security@trekshield.com with steps to reproduce. Good-faith research is covered by our safe harbor.
Get new advisories and notes as they are published: Subscribe via RSS.
Want this rigor on your systems?
A short scoping call, no obligation.