What to do with penetration test results
Turn each finding into a decision, an owner, and a retest your team can verify.
Read articlePeak Security / Blog
Security notes for people building products
We write about the security questions product teams run into while building: who can reach a record, what happens when access ends, and what to do with a test result.
Multi-tenant access control: check the record, not just the role
A user may be allowed to view invoices and still be barred from one particular invoice. Here's how to test that boundary.
Read articleWhen a user loses access, what still works?
What happens to an open session, pending invitation, or API token after someone leaves a team?
Read articleWhat makes a penetration test report useful to engineers?
A severity label is a start. Evidence and reproduction steps let engineers find and fix the issue.
Read article