SECURITY_BLOG .

A worked scope and access matrix, readiness gate, and operational checklist for preparing a SaaS web and API security assessment.

A worked tenant and role matrix, request examples, workflow tests, and regression pseudocode for assessing multi-tenant API isolation.

A fictional cross-tenant export finding shows how evidence, root cause, impact, remediation, and retest criteria become verifiable engineering work.

Snapped exposes an Nginx UI backup together with its decryption material, then uses a local snapd namespace race after SSH access.

Interpreter chains a vulnerable Mirth Connect API, a database password record, and a second evaluation of patient data inside a root-run Python notification service.

Overwatch combines a public software share, a stored SQL credential, DNS control over a linked server's destination, and a PowerShell injection in a local management service.

Browsed turns a server-side browser extension into access to an internal app, then crosses an arithmetic-evaluation boundary and a privileged Python import boundary.

MonitorsFour starts with a broken token comparison, reaches a Cacti container, and uses an exposed Docker Desktop API to reach Windows host files.

Gavel is an auction application whose exposed source reveals a subtle SQL parser mismatch, executable bidding rules, and a privileged rule-processing daemon.

Eighteen uses a SQL impersonation permission to reach a web password hash, then a delegated managed service account to cross an Active Directory privilege boundary.

Conversor turns an uploaded XSLT stylesheet into a file write, scheduled code execution, and a user pivot; a separate sudo configuration choice then grants root execution.

Signed is an assume-breach MSSQL exercise: a low-privilege SQL login can induce outbound authentication, then a compromised service key lets a forged ticket change SQL authorization.

DarkZero crosses three different boundaries: a linked SQL login in another forest, local Windows privilege elevation, and Kerberos delegation across a specially configured forest trust.

Expressway teaches three separate failures: a guessable IKEv1 pre-shared key, reuse of that key for SSH, and sudo behavior that allows local elevation under specific configurations.

TwoMillion is an API authorization lesson that becomes a command-injection and local privilege-escalation chain. Each API response must be interpreted in the context of the caller's role.

Soulmate moves from a file-transfer application to a web shell, an ordinary SSH account, and finally a root-run Erlang service. The important skill is checking the identity at every step.