How Is the Scope of a Web and API Penetration Test Defined?
How companies define the scope of a web and API penetration test: systems, roles, business risks, testing methods, and clear rules of engagement.
IT-Security Insights
Blog
Articles for businesses and development teams, plus technical analysis covering penetration testing, secure development, vulnerability research and bug bounty.
These articles combine specific vulnerabilities, attack chains and practical experience with the question of what they mean for applications, development processes and security decisions.
Security for businesses and development teams
Read article
Open Redirects – When a Small Redirect Becomes a Major Risk
Sometimes a single parameter such as redirect_to is enough to turn a harmless redirect into a genuine security risk.
ReadXSS never dies
Why Cross-Site Scripting remains relevant despite modern frameworks and which assumptions frequently fail in practice.
ReadSecurity research and CVEs
CVE-2025-54531
Path Traversal while extracting plugins in JetBrains TeamCity before 2025.07 allowed Arbitrary File Write on Windows.
ReadCVE-2024-47950
Stored Cross-Site Scripting in the backup settings of JetBrains TeamCity before 2024.07.3.
ReadCVE-2024-47949
Path Traversal in JetBrains TeamCity before 2024.07.3 allowed a backup file to be written to an arbitrary path.
ReadCVE-2024-47948
Path Traversal in JetBrains TeamCity before 2024.07.3 allowed readable files to be disclosed through server backups.
ReadCVE-2024-56353
A backup file in JetBrains TeamCity before 2024.12 exposed credentials and session information.
ReadROP in a Format String Vulnerability
A technical lab analysis covering a format string vulnerability, a controlled ROP chain, and exploit development.
ReadBug bounty and community
Why AI-Generated Bug Bounty Reports Often Fail
AI can analyze source code quickly, yet many automatically generated bug bounty reports lack reproducible impact. Which quality criteria are missing, and where can AI provide useful support?
ReadDuplicates in Bug Bounty: Why They Are More Than Setbacks
Duplicates can be disappointing at first, but often help build reputation, earn private invitations, and support long-term success in bug bounty hunting.
ReadRecon for Beginners – A Structured Search for Vulnerabilities
A practical introduction to structured reconnaissance, safe testing environments, suitable tools, and reproducible example workflows.
ReadYour First Bug Bounty Program – How to Read and Understand the Scope
Many beginners in bug bounty hunting ask the same question: Where do I start?
ReadBug Bounty Hunting – Tips for Getting Started
Bug bounty hunting may sound like quick money, but in reality it is a marathon, not a sprint.
Read