Independent Researcher · FV-SEC-RESEARCH-UNIT

Logic flaws
scanners can't
find.

Automated tools chase CVEs. We chase the gaps between them — SDLC bleed, authentication state abuse, cross-tenant privilege escalation, and business logic bypasses that don't show up in any scan report.

Submit scope → How we work
14+
Programmes active
P1/P2
Finding focus
100%
PoC-backed reports
0
Automated scans used
CRITICALFV-2025-0041Cross-tenant Admin API auth bypass · SaaS platform · CVSS 9.1
HIGHFV-2025-0038Unauthenticated order state manipulation · E-commerce cluster
MEDIUMFV-2025-0033WAF bypass via hex-encoded payload injection · CDN edge
CRITICALFV-2025-0029IDOR on privileged resource endpoint · CVSS 9.4 · Resolved
HIGHFV-2025-0025JWT secret reuse across isolated tenant environments
CRITICALFV-2025-0019Race condition in payment flow allowing double-spend · Fintech
MEDIUMFV-2025-0014Session fixation on OAuth redirect · B2B SaaS
CRITICALFV-2025-0041Cross-tenant Admin API auth bypass · SaaS platform · CVSS 9.1
HIGHFV-2025-0038Unauthenticated order state manipulation · E-commerce cluster
MEDIUMFV-2025-0033WAF bypass via hex-encoded payload injection · CDN edge
CRITICALFV-2025-0029IDOR on privileged resource endpoint · CVSS 9.4 · Resolved
HIGHFV-2025-0025JWT secret reuse across isolated tenant environments
CRITICALFV-2025-0019Race condition in payment flow allowing double-spend · Fintech
MEDIUMFV-2025-0014Session fixation on OAuth redirect · B2B SaaS
// RESEARCH METHODOLOGY

Manual logic probing.
Zero scanner noise.

Every finding we submit is the result of manual exploration of your application's state machine — its trust assumptions, session lifecycle, and privilege boundaries. We don't run Burp scans and call it a pentest.

Reconnaissance
Passive infrastructure mapping. Endpoint enumeration. Trust boundary identification. No active noise on your production stack until scope is confirmed.
Logic Probing
We trace the paths your application trusts implicitly — state transitions, role escalation vectors, parameter tampering across authenticated/unauthenticated boundaries.
Exploitation & PoC
Every critical finding is demonstrated with a working, reproducible proof-of-concept. No theoretical vulnerabilities. If we can't show the hand in the jar, we don't report it.
Disclosure Report
Structured report: severity score, attack vector, reproduction steps, impact statement, and remediation guidance. Formatted for immediate internal triage.
// SAMPLE REPORT STRUCTURE
Critical FV-2025-0041
Cross-Tenant Admin API Access via Workflow HTTP Action
9.1
CVSS v3.1
CWE
CWE-639
Vector
Network
Auth
Low Priv
IMPACT
An authenticated user with low privilege can issue Admin API calls against any tenant's store by manipulating the shop domain parameter in the workflow HTTP action, bypassing tenant isolation entirely.
poc_curl.sh
# Attacker's low-priv store token used against victim tenant
curl -X POST "https://victim-store.myshopify.com/admin/api/orders.json" \
  -H "X-Shopify-Access-Token: [ATTACKER_TOKEN]" \
  -H "Content-Type: application/json"
# Returns 200 + full order data ← CONFIRMED
Submitted via HackerOne · Awaiting triage PoC Verified
// DISCLOSURE LEDGER · REDACTED
SEVERITY
FINDING
STATUS
CriticalCross-tenant Admin API bypass via Flow HTTP action · Global SaaSTriaging
HighAuthentication state abuse in OAuth implicit flow · Retail clusterResolved
CriticalUnauthenticated IDOR granting full account takeover · FintechResolved
HighJWT HS256 secret reuse across isolated tenant namespaces · B2B SaaSResolved
HighRace condition double-spend in checkout flow · E-commerceReviewing
MediumWAF bypass via hex-encoded parameter injection · CDN edge layerResolved
MediumLuxury goods API credential leak via public JS bundle · LVMHAppeal
// CORPORATE ENGAGEMENT PACKAGES
SINGLE STRIKE
$2,500
Standard
✓ Single target domain
✓ Credential & path disclosure audit
✓ Unauthenticated surface mapping
✓ PoC-backed report
– Multi-domain replication check
Request audit
CLUSTER STRIKE
$5,500
Recommended
✓ Multi-domain cluster target
✓ Deep logic analysis & state abuse
✓ Horizontal vulnerability replication
✓ WAF/CDN evasion testing
✓ CVSS-scored full report
Request audit
ECOSYSTEM AUDIT
$10k+
Enterprise
✓ Full infrastructure deep-dive
✓ RSA / auth deep dive
✓ Bulk authentication bypass testing
✓ Executive briefing + remediation call
✓ Ongoing retainer available
Custom quote
// SCOPE SUBMISSION

Initiate engagement

Provide accurate scope. Vague submissions receive no researcher time. We only engage targets we can test thoroughly.

engagement_protocol.md
## Authorization
Submitting this form grants Forge Vertical express written permission to conduct non-destructive security research against the defined scope only.

## Fee Schedule
A 50% non-refundable initiation deposit is required before researcher time is allocated. Balance due on report delivery.

## Zero-Discovery Clause
If no exploitable findings are confirmed, the balance invoice is reduced to 25% of the agreed rate, covering technical labour only.

## Confidentiality
All findings are strictly classified. No disclosure to any third party without explicit written authorisation from the client.

## Scope Limitation
Testing is strictly limited to agreed targets. Any out-of-scope findings are reported immediately and not investigated further without amendment.
// CVSS v3.1 SEVERITY SCALE
Critical 9.0 – 10.0
High 7.0 – 8.9
Medium 4.0 – 6.9
Low 0.1 – 3.9
// NOT IN OUR SCOPE
✕ Automated vulnerability scans
✕ Denial-of-service testing
✕ Physical or social engineering
✕ Out-of-scope target probing
✕ Data exfiltration or destruction
// ACTIVE PLATFORMS
HackerOne
@forge-vertical
Active
YesWeHack
@forge-vertical
Active
// ENCRYPTED CHANNEL

Prefer end-to-end encrypted contact? Reach the research team directly on Signal for time-sensitive scoping calls.

Message on Signal