https://crossfyre.io/publications/blog Distributed recon, offensive-security methodology, and Crossfyre product notes. en-us https://crossfyre.io/publications/blog/rate-limits-are-about-where-you-are https://crossfyre.io/blog/rate-limits-are-about-where-you-are Fri, 11 Sep 2026 00:00:00 GMT Methodology Content discovery, subdomain brute force and port scanning all fail the same way, and it is not speed. Here is what actually gets a large authorized scan finished, and the part of it we cannot do for you. https://crossfyre.io/publications/blog/finding-flutters-certificate-verifier https://crossfyre.io/blog/finding-flutters-certificate-verifier Fri, 11 Sep 2026 00:00:00 GMT Methodology Every interception tool works by editing one Android config file. Flutter has never read that file. Here is how we find the function that actually decides, without a byte signature, and what happened when we ran it against every Flutter app on one phone. https://crossfyre.io/publications/blog/five-rules-that-killed-our-false-positives https://crossfyre.io/blog/five-rules-that-killed-our-false-positives Wed, 09 Sep 2026 00:00:00 GMT Methodology Four separate false positives, four different vulnerability classes, one root cause: the scanner accepted something it had caused as proof. A template matched a marker it had put in the request. An SSRF probe counted a callback our own client made. Here are the four, and the five rules that now stop them, each enforced by a test rather than by review. https://crossfyre.io/publications/blog/tests-that-pass-without-testing-anything https://crossfyre.io/blog/tests-that-pass-without-testing-anything Thu, 27 Aug 2026 00:00:00 GMT Methodology A negative test asserts that a request is refused. Ours were refused, they went green, and five of them never reached the authorization check at all: the request body was malformed, so the server rejected the shape and returned before any permission was evaluated. A passing suite cannot tell that apart from a real refusal. Here is the audit that can. https://crossfyre.io/publications/blog/mobile-tracer https://crossfyre.io/blog/mobile-tracer Wed, 26 Aug 2026 00:00:00 GMT Capabilities On-device traffic capture is common and it all stops at certificate pinning. The Crossfyre Tracer answers pinning with a server-assisted APK repackage that needs no root and no computer, so a pinned Android app on a stock physical handset yields full request and response bodies. Here is exactly how it works, and what it is not. https://crossfyre.io/publications/blog/authenticated-scanning-oauth-sso https://crossfyre.io/blog/authenticated-scanning-oauth-sso Fri, 21 Aug 2026 00:00:00 GMT Guides Almost everything worth testing lives behind a login, and an unauthenticated scan never sees any of it. Here is what it takes to get in, and how we handle your credentials without spreading them across a fleet. https://crossfyre.io/publications/blog/api-authorization-testing-bola-bfla-bopla https://crossfyre.io/blog/api-authorization-testing-bola-bfla-bopla Fri, 21 Aug 2026 00:00:00 GMT Methodology Broken authorization sits at the top of the OWASP API list and template scanners are hopeless at it, because a valid request from the wrong person has nothing malformed to match on. Here is the testing model that does work. https://crossfyre.io/publications/blog/scans-should-leave-from-your-ip https://crossfyre.io/blog/scans-should-leave-from-your-ip Sat, 08 Aug 2026 00:00:00 GMT Capabilities If a hosted scanner sends probes from its own infrastructure, then every customer shares one reputation, and the first person to get that address blocked breaks the product for everyone else. We audited our own platform against that rule and found a component breaking it. This is the rule, the audit, and what we changed. https://crossfyre.io/publications/blog/crash-safe-recon https://crossfyre.io/blog/crash-safe-recon Fri, 12 Jun 2026 00:00:00 GMT Capabilities A reclaimed instance, a closed laptop lid, a target that starts tarpitting. Most tooling loses the whole run to any of those. Here is what we do instead, and why a dead machine costs you nothing. https://crossfyre.io/publications/blog/valkyrie-triage https://crossfyre.io/blog/valkyrie-triage Thu, 11 Jun 2026 00:00:00 GMT Capabilities Raw recon output is a firehose of mostly noise. Valkyrie is the triage layer that reads it, ranks what matters by severity, and tells you why each finding is worth your time. Here is what it does, what it costs, and what it does not do yet. https://crossfyre.io/publications/blog/how-credits-work https://crossfyre.io/blog/how-credits-work Wed, 27 May 2026 00:00:00 GMT Guides Your plan sets your limits and unlocks capabilities. Scanning inside them is not metered, so no per-scan fee and no billed minutes. Credits are a separate wallet, and Valkyrie is the only thing that spends them.