The UnboundCompute blog
Writing on web security
-
What is insecure deserialization?
Insecure deserialization explained from zero: how rebuilding objects from untrusted bytes leads to tampering and code execution, and how to prevent it.
-
What is XXE injection and how does it work?
Learn how xxe injection works from zero: XML, DTDs, external entities, file reads, SSRF, blind and out of band leaks, and the…
-
What is SSRF? Server Side Request Forgery Explained
Server side request forgery (SSRF) lets an attacker make your server send requests for them. Learn how SSRF works, why it is…
-
Web and API Security Glossary: Vulnerabilities and Terms Explained
A plain language glossary of web application vulnerabilities and security terms, from XSS and IDOR to SSRF and business logic flaws. Built…
-
Why we only report proven vulnerabilities
We use vulnerability verification to prove a bug is real and exploitable before we report it, so your team gets signal, not…
-
How UnboundCompute differs from a vulnerability scanner
An ai vulnerability scanner floods you with maybes. See how an autonomous researcher reasons about your app, proves a finding, and reports…
-
How UnboundCompute works, from understanding an app to proving a bug
See how UnboundCompute does ai penetration testing: understand an app, test an assumption, run an experiment, and prove a real bug with…
-
Why we are building UnboundCompute
Most automated security testing checks known bugs and misses access control and logic flaws. Here is our bet on a researcher that…
-
Meet UnboundCompute, an autonomous security researcher for web apps and APIs
Meet UnboundCompute, an autonomous security researcher that brings autonomous penetration testing to web apps and APIs by testing assumptions, not lists.
-
Teardown: chaining small bugs into a real breach
An exploit chaining teardown: see how three low severity bugs in an invented app combine into one account takeover, and how to…