https://shellvoide.com/blog/blog The Shellvoide security blog: AI-driven penetration testing, vulnerability research, and application security insights from the team behind KLUE. en-us info@shellvoide.com (Shellvoide) info@shellvoide.com (Shellvoide) Fri, 17 Jul 2026 00:00:00 GMT https://shellvoide.com/blog/blog/websocket-auth-bypass-bug-bounty-case-study https://shellvoide.com/blog/blog/websocket-auth-bypass-bug-bounty-case-study A detailed bug bounty writeup. Our autonomous agent KLUE spent hours proving a hardened crypto-mining marketplace was hardened, then reverse-engineered its HMAC signing scheme, mapped a STOMP WebSocket buried in the authenticated app bundles, and discovered it performed no authentication at all, routing private per-tenant channels off a client-supplied parameter. An unauthenticated, cross-tenant data leak, responsibly disclosed and rewarded. Fri, 17 Jul 2026 00:00:00 GMT info@shellvoide.com (Shellvoide) kluecase-studybug-bountyai-pentestingwebsocket-securitybroken-authenticationstompbolaidorautonomous-securityappsecpentesting