Farchase
Real-World Security Outcomes
Real vulnerabilities we found, the business impact they carried, and how they were fixed. All engagements anonymized — client names withheld to protect confidentiality.
Why Security Teams Choose Farchase
Manual, exploit-driven testing that finds the bugs your last pentest missed — delivered fast, and priced so you can do it often. See the depth, the proof, and the client attestation.
Read why teams switch →Cross-account IDOR: one customer could edit another's data
During manual testing of object references, our researchers found that swapping a resource ID in an API request allowed authenticated users to read and modify resources belonging to other customer accounts — invisible to automated scanners because every response returned 200 OK.
All Findings
Selected vulnerabilities across web, API, cloud & mobile engagementsHTML injection → SSRF via PDF export
An unsanitized Work Order title, rendered by a server-side PDF engine, forced the backend to make attacker-controlled outbound requests.
Internal service access, cloud metadata reach, and export DoS for all users.
Output encoding + disabled remote fetches + egress allow-listing. Rated Critical (CVSS ~9.0).
Admin able to delete the Super Admin account
A missing server-side authorization check on the removeUser mutation let an Admin delete the highest-privileged Owner account.
Organization takeover and lock-out of legitimate administrators.
Role-hierarchy authorization enforced server-side; deny by default. Rated Critical (CVSS up to 9.6).
Injecting messages into a victim’s chat
Swapping two user-controlled IDs let any authenticated user write into — and read back — another user’s AI assistant conversation.
Cross-user message injection plus disclosure of the victim’s existing messages.
Object-level ownership checks enforced across the reference chain. Rated High (CVSS ~7.6).
Critical SQL injection & stored XSS in customer flows
SQL injection and stored XSS in customer-facing flows, reachable pre-authentication.
Potential customer data leakage and session hijacking.
Parameterized queries and output encoding applied; posture measurably improved.
Standard users performing admin-level actions
Lower-privileged users could perform admin actions via direct API calls.
Complete role-hierarchy bypass.
Server-side RBAC validation added; confirmed fixed on retest.
Public bucket + IAM chain to admin access
A public storage bucket and over-permissive IAM role chained into admin-level account access.
Full cloud-account compromise path.
Bucket policies locked down and IAM roles right-sized; escalation path eliminated.
Session tokens recoverable from lost devices
Session tokens and PII stored unencrypted on-device, recoverable from a lost or rooted phone.
Account takeover from physical device access.
Keychain/Keystore storage + certificate pinning adopted; validated on retest.
Restricted actions possible before publication
A business-logic flaw allowed restricted actions on workflows before they were published.
Unauthorized access to unpublished workflows and pre-release functionality.
Access control enforced at the API level; validated on retest.
Bug bounty program from zero to 100+ valid reports
Launched a bug bounty program from scratch — scoping, researcher onboarding, and full triage.
No internal capacity to handle researcher reports and duplicates.
100+ valid vulnerabilities reported within the first 3 months.
All engagement details anonymized to protect client confidentiality. References available on request under NDA.
Latest from Farchase
Your Application Has Bugs Like These
Find them before attackers do — expert pentesting, Chazer AI, and live portal reporting.