Five vulnerabilities we find in almost every web app
After hundreds of tests, the same issues keep showing up. Here's how to fix them before your next pentest.
We test a lot of web applications. Different stacks, different industries, yet the same five problems show up again and again.
1. Broken access control
Change /api/invoices/1042 to /api/invoices/1043 and you’re reading someone else’s invoice. Insecure direct object references remain the number one issue we report.
Fix: check authorisation on every request, server-side, against the logged-in user. Never trust IDs from the client.
2. Missing rate limits
Login, OTP and password-reset endpoints without throttling invite credential stuffing and OTP brute-forcing.
Fix: rate-limit by account and IP, and lock out after repeated failures.
3. Verbose errors
Stack traces in production responses hand attackers your framework versions, file paths and sometimes SQL queries.
Fix: generic error pages for users; detailed logs for you.
4. Weak security headers
No Content-Security-Policy, no Strict-Transport-Security, cookies without HttpOnly or Secure.
Fix: a few lines of configuration close whole classes of attack.
5. Outdated dependencies
That three-year-old JavaScript library has a public exploit.
Fix: automate dependency scanning in CI and patch on a schedule.
None of these require exotic skills to exploit, and none are hard to fix. Book a test and we’ll tell you which ones you have.
Worried about the same risks?
Our team can check your exposure in days, not months.
