https://trekshield.com/resources/research/ Technical write-ups and security advisories from the TrekShield bench. en Fri, 20 Mar 2026 00:00:00 GMT https://trekshield.com/blog/bola-vs-bfla-api-authorization/ https://trekshield.com/blog/bola-vs-bfla-api-authorization/ Fri, 20 Mar 2026 00:00:00 GMT Technical note Broken object-level and broken function-level authorization top the OWASP API Security list for a reason. Here's the difference, why both are missed, and how to test for each. https://trekshield.com/blog/what-a-good-pentest-report-contains/ https://trekshield.com/blog/what-a-good-pentest-report-contains/ Tue, 24 Feb 2026 00:00:00 GMT Technical note The report is the product. Here's what separates one your engineers act on from one that gets filed and forgotten — section by section. https://trekshield.com/blog/business-logic-flaws-scanners-miss/ https://trekshield.com/blog/business-logic-flaws-scanners-miss/ Mon, 02 Feb 2026 00:00:00 GMT Technical note The highest-impact vulnerabilities rarely look like vulnerabilities. They're valid requests that do something the business never intended — and only a human can spot them. https://trekshield.com/blog/idor-multi-tenant-saas/ https://trekshield.com/blog/idor-multi-tenant-saas/ Wed, 14 Jan 2026 00:00:00 GMT Technical note Broken object-level authorization is the flaw scanners miss most. Here is how tenant-isolation bugs actually happen, and how we prove real impact by hand.