Idor

Published on
July 17, 2026
KLUE vs. a Hardened Target: One Bug, No Signature Required
klue case-study bug-bounty ai-pentesting websocket-security broken-authentication stomp bola idor autonomous-security appsec pentesting
A detailed bug bounty writeup. Our autonomous agent KLUE spent hours proving a hardened crypto-mining marketplace was hardened, then reverse-engineered its HMAC signing scheme, mapped a STOMP WebSocket buried in the authenticated app bundles, and discovered it performed no authentication at all, routing private per-tenant channels off a client-supplied parameter. An unauthenticated, cross-tenant data leak, responsibly disclosed and rewarded.
Published on
March 30, 2026
API Pentesting Checklist: What Most Teams Miss
api-security api-pentesting-checklist owasp-api-top-10 graphql-security rest-api-security jwt-security idor appsec
Complete API pentesting checklist with OWASP API Top 10 (2023), BOLA/IDOR tests, JWT and OAuth checks, GraphQL security testing, SSRF payloads, business logic abuse scenarios, and reporting guidance.

KLUE vs. a Hardened Target: One Bug, No Signature Required