Case studies

Real engagements, told plainly.

What we found, why it mattered, and the change we asked for. Every story is anonymised: no names, no evidence, just the pattern your team can learn from.

22findings, 2 critical
Non-profitWeb application pentest
A CMS key in the frontend, and the donor records behind it
A donation site shipped its CMS key in public JavaScript, and anyone who found it could read tax forms, payments and donor history.
November 5, 2026

Loading…

A CMS key in the frontend, and the donor records behind it

A CMS key in the frontend, and the donor records behind it