Security handled from code to cloud
One AI-native platform does all your tactical security work, from finding to fix.
Northwind Labs API Penetration Test — Aug 20, 2026
Ready for remediation
Penetration test lifecycle.
- Scoping20 Aug, 09:19
- Scheduled20 Aug, 09:19
- In progress20 Aug, 09:19
- Ready for remediation20 Aug, 09:43
- Completed
Perform a full penetration test of the Northwind Labs API across the entire web and API surface: recon and enumeration first, then validate and bounded-exploit vulnerabilities across every class. Chain confirmed findings into attack paths, and deliver the consolidated report.
Any authenticated session reads any user's profile by changing the id in the path. Retrieved the administrator's record, including the password hash and a live API key.
Two independent paths to admin: an unauthenticated call to /api/admin/users, and a profile PATCH that sets role:admin with no ownership check. Both grant full administrative access.
UNION-based SQL injection on /api/users returned all 2,847 user rows with password hashes and session tokens from a low-privilege session.
The webhook configuration endpoint fetched the cloud metadata address and recorded temporary IAM credentials in the delivery log.
The login endpoint has no rate limit, so credential stuffing is practical, and a session survives a password change. No account was taken over inside the engagement window.
Blocked by: No weak credential recovered within the bounded attempt budget
No command execution primitive was reachable. File read and SSRF were confirmed, but neither chains to code execution on this surface.
Blocked by: No exec, spawn or eval primitive in the reachable attack surface
- 1GET /api/users?search=
An authenticated low-privilege caller sends a UNION-based payload to the user search endpoint. The database returns every row of the users table, including bcrypt hashes and unexpired session tokens.
Full read access to the user table, credentials and live sessions from a standard account.
- 2POST /api/webhooks
A session token lifted from the SQL injection authenticates a webhook write. The webhook URL points at the instance metadata address, and the delivery log records the temporary IAM credentials it returned.
Cloud role credentials obtained from an application-layer flaw, reaching storage outside the application's own boundary.
- 3PATCH /api/users/{id}
The profile update endpoint performs no ownership check. A standard account sets its own role to admin, and the admin API accepts it on the next request.
Privilege escalation to administrator from any registered account.
- 4GET /api/admin/users (no authentication)
The admin collection is readable with no Authorization header. The profile serializer includes api_key, so one anonymous request yields working credentials for every account.
Working API keys for the whole tenant, from an unauthenticated position.
- 5Any page the victim visits
The API reflects any Origin with credentials enabled, so a page under the attacker's control reads authenticated responses on the victim's behalf for as long as the session lasts.
Authenticated reads from a third-party page, with no interaction beyond a visit.
- Created via
- POST /api/users
- Location
- auth_user
- Created via
- POST /api/keys
- Location
- api_credential
Honey-Corp/honeybucket
The repository contains multiple committed secrets (private keys, API tokens, database credentials, OAuth client secrets) and hardcoded credentials in source code. A TLS private key and .env files with real tokens are tracked in git. The Django settings file hardcodes a GitHub PAT, Django SECRET_KEY, and database password directly in source. A stored XSS vector exists via the Django markdown-to-HTML rendering pipeline using |safe.
Cloud infrastructure
royal-jelly-prod
the-hive-edge
waggle-dance-web
pollen-store
drone-workers-stagingroyal-jelly-prod
the-hive-edge
waggle-dance-web
pollen-store
drone-workers-staging
Security testing and monitoring for teams that ship fast
Find vulnerabilities, fix what matters, and keep your code, cloud, and running systems secure without slowing down engineering.
Get an audit-grade pen test in hours, not weeks
Run an autonomous penetration test that validates vulnerabilities through exploitation and delivers an audit-ready report. Retest fixes on demand without scheduling another engagement.
Explore pen testing →VULN-1BA6
- Status
- CONFIRMED
- Confidence
- High
- Impact Score
- 5 / 5
- Likelihood
- 5 / 5
- Exploitation Depth
- impact demonstrated
Reproduction Steps
- Send GET /api/admin/users with no Authorization header
- Verify HTTP 200 and the full user collection in the response body
- Repeat against /api/admin/billing to confirm write access
Proof of Impact
Retrieved 2,847 user records and modified the billing plan on account 1 from an unauthenticated session.
Find and fix vulnerabilities before they ship
Scan your code, dependencies, and running app for security issues. Get fix recommendations in your pull requests or use AI to generate patches for existing vulnerabilities.
Explore application security →fencer-code13m ago
SQL injection in get_user via f-string interpolation
User input is interpolated straight into a raw SQL query. An attacker can dump auth_user, including password hashes.
Recommendation: Use a parameterized query.
Suggested change
Some checks haven't completed yet
1 in progress check
- FencerIn progress — Code security scan
No conflicts with base branch
Merging can be performed automatically.
You can also merge this with the command line.
All checks have passed
2 successful checks
- FencerSuccessful in 1m — Fencer Scan Results
- Fencer / AI Security ReviewSuccessful in 2m — AI security review
No conflicts with base branch
Merging can be performed automatically.
You can also merge this with the command line.
Catch cloud misconfigurations before they cause problems
Flag risky infrastructure changes in pull requests and find misconfigurations in your deployed cloud. Keep your architecture diagram and security evidence up to date automatically.
Explore cloud security →EKS Clusters should have the public access disabled
VULN-F2G
- Status
- Open
- Severity
- Critical
- Priority
- Urgent
- First Seen
- 8 months ago
- Location
- local_copy_of_modules/files_copied_from_modules/wrongsecrets/aws/main.tf
Code
Detect suspicious activity across your stack
Monitor cloud, SaaS, and identity events with customizable detection rules. AI investigates flagged events, explains what happened, and recommends next steps.
Explore security monitoring →Suspicious sign-in activity for j.nolan@honey-corp.com
Sign in from an address this account has never used, minutes after a failed attempt from another country · 98% confidence
Next steps:
- Contact j.nolan@honey-corp.com and confirm whether they performed this sign-in
Delegate the security grunt work to agents
Use Fencer's agents to investigate findings, prepare fixes, and gather evidence without doing every step by hand.
All pull requests
Fix VULN-B2M: Discovered a private key
#99·fencer-code[bot]opened 3 weeks agoBot·3/3 checks passed
Fix VULN-AZX: PKCS #12 File Exposure
#98·fencer-code[bot]opened 3 weeks agoBot·3/3 checks passed
Fix VULN-AZZ: Stripe Access Token
#95·fencer-code[bot]opened 3 weeks agoBot·3/3 checks passed
Triage
96% less noise
AI triage filters findings so your team knows what needs attention.
Remediate
Let agents handle the fixes
Fencer's agents fix supported vulnerabilities and open pull requests for review.
Prove
Automate audit evidence
Fencer syncs security evidence to Vanta, Drata, and Secureframe as work happens.
Triage
96% less noise
Fencer triages every finding so only the ~4% that's real reaches your team.
Remediate
AI fixes, not just findings
Agents write the fix and open the pull request, with the reasoning attached.
Prove
Evidence that syncs itself
Vanta, Drata, and Secureframe stay current automatically.
“Fencer ensures we have a confident, comprehensive security and compliance posture, without generating a lot of toil for our small team.”
Ben PapillonCTO & Co-Founder, Schematic
Works with the tools you already ship with
Explore integrations →Lean teams, shipping securely
Healthcare
We don't have time to constantly stop and run separate security processes… security is just part of our workflow, which makes a big difference for a lean engineering team.
Prithvi Narasimhan
CTO, Rely Health
Proptech
As a small startup, we don't have the ability to hire dedicated security staff. Fencer gave us the tools and confidence we needed to secure our platform without adding headcount.
Jason Byck
CTO, Renew
Construction
Before Fencer, we simply wouldn't have been able to close larger enterprise customers. With Fencer, we achieved SOC 2 and unlocked deals we couldn't pursue before.
Ari Baranian
CEO, Pirros