Skip to content

CHAPTER 02 · ATTACK · CATCH WHAT REVIEW CAN'T SEE

Think like the intruder. Fix like the owner.

AI agents map your app, form attack hypotheses, prove what's exploitable on staging, and hand you the fix. Reports are SOC 2 and ISO ready.

Get Feluda with Puku TeamSee a sample report
FELUDA ATTACK · REPORTSOC 2 · ISO

White-box assessment of checkout-api

2exploited
331blocked
42endpoints

FEL-142 · Cross-tenant order read

FEL-143 · JWT alg=none impersonation

11 hypotheses disproved, with evidence

ACTION REQUIRED

0

agents per assessment

0

targets: web, API, Android, MCP, LLM

0

false positives reported as exploits

Daily

attack-surface monitoring

01 TARGET · 02 ACCESS · 03 REVIEW & LAUNCH

Point it at staging. That's the setup.

Feluda pre-fills the target from your repo, verifies ownership through your deployment, and respects the paths you never want touched.

What should we attack?

We pre-filled this from puku/checkout-api. Change anything that looks off.

Target type

Base URL

Verified automatically via your GitHub deployment. Use staging — some tests create or delete data.

Code context (recommended)

puku/checkout-api
docs/openapi.yaml

Never touch (optional)

ESTIMATE

~4.0K requests

of 12.4K left this month · paced across 2 × 5h windows · ~3h

Endpoints mapped42

Modewhite-box

Excluded paths2

Paced to stay inside your 5h and weekly windows. Pauses safely if you hit a limit.

THE FINDING · FEL-142

Proof, not a guess. Replay included.

Every confirmed issue comes with the exact requests, the impact in plain words, and the fix. Click Retest after you ship it.

CRITICAL · CVSS 9.1✓ Validated by 2 agentsFEL-142 · CWE-639 · OWASP API1:2023

Any customer can read another tenant's orders

WHAT HAPPENED

Logged in as customer-b, the agent changed the order id in GET /v1/orders/{id} and received tenant A's full order — name, address and last 4 card digits. The handler loads by id without checking the caller's tenant.

PROOF
GET/v1/orders/8812REQUEST

Hoststaging.checkout.puku.sh

AuthorizationBearer eyJ…customer-b

Owns orderNo · belongs to tenant-a

200 OKexpected 403RESPONSE · 182ms

id8812

tenanttenant-a

customerAyesha K.PII

card•••• 4242PCI

SUGGESTED FIX
src/orders/handler.ts+2−1
41const order = await db.orders.findFirst({
42− where: { id: params.id },
42+ where: { id: params.id, tenantId: ctx.user.tenantId },
43});
44+if (!order) throw new NotFound();

ATTACK PATH · REPLAYING

1
Sign up as any customerPOST /signup
2
Walk sequential order idsGET /v1/orders/8800…8899
3
Read every tenant's orders + PII
4,812 orders2 tenants

Found inRun #3 · 2h ago

Introduced byPR #198 · a3f9e1c

ComplianceSOC 2 CC6.1 · ISO A.8.3

Fix effort~5 min · 1 file

After you merge, Feluda retests this exact exploit automatically and closes the finding when it fails.

And proof of what was tested, endpoint by endpoint.

Attack depth per endpoint

nonedeepexploited
Access controlAuth / JWTInjectionBusiness logicSSRFFile uploadRate limitingInfo leak

← 42 endpoints, grouped by flow →

AI CODE ANALYSIS

A security audit of the code itself.

Pick repos and docs. See the exact request cost before you start. Results land in Pull Requests and Slack.

CODE SECURITY AUDIT · 2 REPOS

Ready when you are

4.2Krequests · of 12.4K left · ~2h
● this audit 4.2K● docs context −600● left this month 8.2K / 20K

total4.2K req

ATTACK SURFACE · MONITORED DAILY

Everything you expose to the internet.

Subdomain takeovers, leaked credentials, open ports and spoofable mail, each with the one action that fixes it.

ASSETISSUESCANACTION
promo.puku.shCNAME → puku-promo.herokuapp.com (unclaimed)Takeover possibleSurface
3 employee accounts@puku.sh · seen in a 2026 stealer-log dumpLeaked credentialsDarknet
db-replica.puku.sh:5432PostgreSQL reachable from the internetExposed database portSurface
mail.puku.shDMARC p=none · SPF softfailSpoofable senderQuick scan
NEXT · THE METHODSee how the detective works a case, step by step.→

YOUR NEXT CASE

Put Feluda on your next pull request.

Continue with PukuIncluded in Puku Team & Enterprise