Welcome to the Xowia Blog

For over a decade, most of our best work has lived inside private reports and coordinated-disclosure threads. This blog is where we start sharing the parts we can share — the methodology, the mindset, and the lessons that don't need an NDA.

What you'll find here

• Disclosure writeups — sanitised stories behind vulnerabilities we've reported.
• Methodology deep-dives — how we approach web, mobile, API, cloud and IoT targets.
• Field notes — practical tips from real engagements and training sessions.

Why we're doing this

We believe the security community gets stronger when practitioners share how they actually work. Scanners find the obvious; people find the interesting. If reading one of these posts helps a developer ship something a little harder to break, that's a win.

Our rule stays the same as always: report privately, allow a fair remediation

window, and never go beyond a proof of concept.

A quick example

Here's the kind of thing we love to catch — an authorization check that trusts a client-supplied identifier:

GET /api/v2/invoices/1042
Authorization: Bearer <user-A-token>

# Works for user A... and also returns user B's invoice 1043. That's a BOLA/IDOR.

One missing server-side ownership check, one leaked customer record. Multiply by every object in the API and you have a breach.

Want us to look at your systems before someone else does? Get in touch — we respond within 24 hours.