We asked outsiders to break in. They couldn't.

What they tried

Eight kinds of attack, each one checked with proof before it counts.

• Injection & bad input Sneaking commands into forms and requests.
• Sign-in & sessions Guessing, stealing or reusing logins.
• Access control A cashier reaching settings or records reserved for an owner.
• Weak settings Default passwords, open debug pages, loose headers.
• Data leaks Phone numbers, bills or keys showing up where they shouldn't.
• Encryption Reading traffic or cracking weak keys.
• Server tricks & logic Making our server fetch things for them, or bending order and payment rules.
• Business isolation One business trying to access another business's private data, in both directions.