OFFENSIVE RESEARCH & APPLIED AUDITS

Security Architecture & Incident Teardowns

Practical breakdowns of logic bugs, billing desyncs, stolen session tokens, and cross-feature vulnerability chains. Written for SaaS builders who care about real-world threat models over automated scanner noise.

Incident Analysis•November 4, 2026

4 min read

The Scribd Notice: What 'Partial Card Data' Exposure Means for SaaS Teams

Many SaaS apps never store full credit card numbers, but exposed billing metadata is often enough to fuel devastating spear-phishing campaigns. Here is what builders should audit.

Key Takeaways:

Scribd notified users of a security incident involving billing metadata
No full credit card numbers were exposed, but card last-4, country, expiry, and payment history were accessible
Spear-phishing risk is high when attackers possess verified customer payment timestamps

Source: Hacker News: Tell HN: Scribd BreachedRead Analysis

Threat Intelligence•November 4, 2026

5 min read

When the Stealer Has an Analyst: VOLTA and What It Means for SaaS Session Tokens

Cisco Talos revealed VOLTA, a modular infostealer that feeds exfiltrated victim dossiers into LLMs to automatically prioritize high-value targets. Why token revocation is now mission-critical.

Key Takeaways:

VOLTA extracts browser cookies, session tokens, Discord/Telegram sessions, and cloud keys
An automated LLM chain evaluates exfiltrated assets and ranks victims by monetization potential
SaaS platforms must enforce short-lived sessions and instantaneous server-side revocation

Source: Cisco Talos Threat ResearchRead Analysis

Deep Logic Exploits•November 4, 2026

6 min read

Bugs in the Seams: Lessons from the ChatGPT postMessage & CSP Vulnerability Chain

A recently fixed P1 vulnerability demonstrated how complex modern web apps can be exploited through seams between isolated features. A deep dive into postMessage, unsandboxed iframes, and CSP bypasses.

Key Takeaways:

Each individual feature was designed reasonably, but their combination created an exploitable chain
An unvalidated postMessage listener allowed raw HTML injection into a parent frame
Missing iframe sandbox attributes allowed the child frame to inherit the trusted parent origin

Source: Responsible Disclosure (Resolved Oct 26, 2026)Read Analysis

Audit your own SaaS before threat actors do

We run authorized blackbox logic audits on SaaS backends, state machines, and payment routes. Every finding includes a reproducible cURL PoC and drop-in code fix within 24 hours.

Run Free Recon View Sample Report