Publications
Blog
How things work and what changed. Papers and reports are in publications.
-
Rate limits are about where you are, not how fast
Content discovery, subdomain brute force and port scanning all fail the same way, and it is not speed. Here is what actually gets a large authorized scan finished, and the part of it we cannot do for you.
4 min read methodologyreconrate-limits -
Flutter doesn't care what Android trusts
Every interception tool works by editing one Android config file. Flutter has never read that file. Here is how we find the function that actually decides, without a byte signature, and what happened when we ran it against every Flutter app on one phone.
5 min read mobileandroidflutter -
Every false positive we have shipped had the same cause
Four separate false positives, four different vulnerability classes, one root cause: the scanner accepted something it had caused as proof. A template matched a marker it had put in the request. An SSRF probe counted a callback our own client made. Here are the four, and the five rules that now stop them, each enforced by a test rather than by review.
9 min read false positivesscanningdetection -
Five of our authorization tests were passing for the wrong reason
A negative test asserts that a request is refused. Ours were refused, they went green, and five of them never reached the authorization check at all: the request body was malformed, so the server rejected the shape and returned before any permission was evaluated. A passing suite cannot tell that apart from a real refusal. Here is the audit that can.
8 min read testingauthorizationapi -
Intercept a pinned mobile app from an unrooted phone
On-device traffic capture is common and it all stops at certificate pinning. The Crossfyre Tracer answers pinning with a server-assisted APK repackage that needs no root and no computer, so a pinned Android app on a stock physical handset yields full request and response bodies. Here is exactly how it works, and what it is not.
7 min read mobileandroidinterception -
A scanner that stops at the login page is testing a different app
Almost everything worth testing lives behind a login, and an unauthenticated scan never sees any of it. Here is what it takes to get in, and how we handle your credentials without spreading them across a fleet.
4 min read guidesauthenticated-scanningoauth -
The bug class scanners cannot see: BOLA, BFLA and BOPLA
Broken authorization sits at the top of the OWASP API list and template scanners are hopeless at it, because a valid request from the wrong person has nothing malformed to match on. Here is the testing model that does work.
4 min read methodologyauthorizationbola -
Whose IP address is your scanner using?
If a hosted scanner sends probes from its own infrastructure, then every customer shares one reputation, and the first person to get that address blocked breaks the product for everyone else. We audited our own platform against that rule and found a component breaking it. This is the rule, the audit, and what we changed.
7 min read architecturemulti-tenancyegress -
How Crossfyre scans survive a crashed node
A reclaimed instance, a closed laptop lid, a target that starts tarpitting. Most tooling loses the whole run to any of those. Here is what we do instead, and why a dead machine costs you nothing.
6 min read resiliencearchitecturenodes -
Valkyrie: turning the scanner firehose into ranked findings
Raw recon output is a firehose of mostly noise. Valkyrie is the triage layer that reads it, ranks what matters by severity, and tells you why each finding is worth your time. Here is what it does, what it costs, and what it does not do yet.
6 min read valkyrieaifindings -
Scanning is not metered. Credits are only for AI.
Your plan sets your limits and unlocks capabilities. Scanning inside them is not metered, so no per-scan fee and no billed minutes. Credits are a separate wallet, and Valkyrie is the only thing that spends them.
5 min read billingcreditspricing