See your SaaS through the eyes of a real attacker.
“What if someone found and exploited a vulnerability? What would the impact be?” Haku answers with detailed analysis and technical evidence.
31%
of breaches start with vulnerability exploitation
for the first time in 19 years of DBIR it passed stolen credentials, which fell to 13% (Verizon DBIR 2026)
US$ 4.99M
is the global average cost of a breach
an all time high for the series (IBM 2026)
+12%
was the rise in breach cost in a single year
the highest level ever recorded (IBM 2026)
R$ 6.7M
is the average cost of a breach in Brazil
IBM Cost of a Data Breach 2026
What it is
The difference between thinking you are secure and being able to prove it.
- What if I send a quote in the search field?
- What if I swap the order ID for another customer's?
- What if I save a script as my profile name?
- What if the webhook accepts an internal URL?
- What if the coupon accepts a negative value?
- What if I request the reset code a thousand times?
- What if the revoked invite still works?
- What if I swap the tenant in the URL?
- What if the API answers any origin?
Why it matters
The next flaw was not in the last pentest.
None of the changes below is careless. They are legitimate fixes and improvements, reviewed in code review and approved by CI. Every one of them also opened a door that did not exist during the previous test.
None of them has a CVE. None shows up in a scanner. All of them were born after the last report.
fix: username rejected accented characters
Stored XSS
Validation loosened to let ç and á through. <script> came through with them, and a username became code running on the screen of whoever opens the list.
feat: export report as CSV
IDOR
The endpoint takes a report number and returns the file. Changing that number in the URL returns another company's report.
feat: import profile photo by URL
SSRF
The server fetches the image from whatever address the user types. Point it at the cloud's internal address and it fetches the machine's credentials.
fix: profile form was not saving the phone number
Mass assignment
The update now accepts the whole object the screen sends. Along with the phone number you can send the field that decides who is an administrator.
refactor: centralize the permission check
Broken access control
It now runs before every route. Except the three that had their own guard, were cleaned up in the refactor and ended up with none.
Methodology
Built from real attacks. Not generic checklists.
Injection
SQL Injection, Cross Site Scripting (XSS), Server Side Request Forgery (SSRF)...
Broken Access Control
IDOR, Broken Object Level Authorization (BOLA), Broken Function Level Authorization (BFLA)...
Broken Authentication
MFA bypass, credential stuffing, session hijacking...
Sensitive Data Exposure
Excessive Data Exposure, Mass Assignment, secrets in the bundle...
Business Logic Flaws
Price manipulation, payment flow bypass, coupon abuse...
Security Misconfiguration
Permissive CORS, public bucket, debug endpoint left live...
First pentest
No high or critical finding, half the price.
On your first pentest with Haku, if no high or critical vulnerability is found, you pay 50% of the price. Severity is scored by CVSS v3.1 Base Score, the public standard any auditor can check. The risk of finding nothing is ours.
Valid once, on the first contract.
Next step
Schedule a pentest with scope, method and delivery aligned with your product.
Scope and proposal are defined based on your application. Haku runs the offensive assessment with technical rigor, reproducible documentation and remediation guidance — so engineering can act and leadership can see risk clearly.