Yaamlabs
Case studies

From the first finding to the fix.

Anonymized write-ups from real engagements. The finding, the reasoning that found it, and what changed after.

Private photos reachable by reference

Consumer internet, Web & API penetration test, CRITICAL

A dating platform let members share photos privately with matches. We were asked whether a private photo could be reached by someone it was never shared with, and whether profiles could be collected in bulk.

Transaction tampering through a DEX front-end

Web3, Web & API penetration test, CRITICAL

A decentralised exchange asked us to test the web layer around its contracts. Their concern was precise: the smart contracts were audited, but the interface users actually trust to build a transaction was not.

Forged eligibility in an airdrop proof

Web3, Smart contract audit, HIGH

A token distribution proved who was eligible with a compact cryptographic proof against a published root. We were asked whether the proof could be satisfied by someone who was never on the list.

Prompt injection reached the refund tool

AI, LLM red team, CRITICAL

A support agent read customer messages and could issue refunds. Those two facts were connected by nothing but the model’s judgement.

Account takeover through a linked login

Consumer internet, Web & API penetration test, CRITICAL

A consumer platform let people sign in with a third-party account and message each other privately. We were asked whether the linked login could be turned against the account, and whether private messages stayed private.

Reward inflation in a governance token

Web3, Smart contract audit, CRITICAL

A lending protocol was launching a governance token with a holding-reward feature that granted a multiplier for longer-held balances. We were asked to find a way to manipulate the reward logic before it went live with real liquidity.

A cached discount and a redirected payout

E-commerce, Web & API penetration test, HIGH

A marketplace connected buyers with independent merchants and paid merchants on a schedule. We were asked whether a discount could be made to apply where it should not, and whether a payout could be pointed at the wrong account.

Session reuse in a donation flow

Nonprofit, Web & API penetration test, HIGH

A donation platform took one-off and recurring gifts and let donors manage their details. We were asked whether a session could outlive its owner, and whether card data was handled the way donors would expect.

Matter access across the wrong client

Legal services, Web & API penetration test, HIGH

A legal practice platform organised documents by matter, each belonging to a client. We were asked whether a user on one matter could reach documents filed under another.

Red team against a client portfolio portal

Wealth management, Red team & code review, CRITICAL

A wealth management firm wanted to know how its defences held against a patient, targeted adversary rather than a checklist. The objective was set narrowly: reach the client portfolio data, quietly, and show the path.

Document access and guessable reset links

Government contracting, Web & API penetration test, HIGH

A supplier portal let organisations download documents and reset their own passwords. We were asked whether a document could be pulled by the wrong organisation, and whether a reset link could be anticipated.

Legacy HL7 on the clinical VLAN

Healthcare, Internal network review, HIGH

An HL7 interface from a previous decade was still running. It was supposed to be isolated. From the clinical VLAN, it answered.

An outdated plugin ran our code

Content management, Web application penetration test, HIGH

A public marketing site ran on a common content platform with third-party plugins. We were asked whether the site could be used as a way onto the server behind it.

Cloud administrator from a single workstation

Cloud SaaS, Cloud & Kubernetes security, CRITICAL

A company running entirely in the cloud asked us to assume the worst realistic starting point: one developer workstation compromised, and nothing else. The question was how far that single machine reached.

Unreleased assets and a stored script

Media and advertising, Web & API penetration test, HIGH

An agency platform hosted campaign assets before launch and let clients comment on them. We were asked whether an asset could be read by the wrong client, and whether a comment could carry more than text.

Staking rounding drift

DeFi, Smart contract audit, CRITICAL

A staking contract paid rewards proportionally. The arithmetic was correct in every individual case and wrong in aggregate.

Default credentials to domain admin

Enterprise IT, Internal network penetration test, CRITICAL

An internal test started from an ordinary desk network port, with no account. We were asked how far a visitor with a network cable could reach.

A withdrawal that ran twice under load

Crypto exchange, Web & API penetration test, CRITICAL

An exchange let customers withdraw balances to external addresses. We were asked whether the balance check and the payout could be made to disagree, and whether an operator surface was reachable without one.

Domain takeover through a certificate template

Financial services, Network penetration test, CRITICAL

A large financial enterprise asked us to assess its internal network from a standard low-privilege starting point: a single ordinary account, no special access, the position an attacker reaches after one foothold.

Client-side price on a booking flow

Booking and marketplace, Web & API penetration test, HIGH

A booking platform sold access to premium workspace by the hour. We were asked whether the price a member paid was the price the server set, or the price the browser sent.

Cross-tenant statement access

Banking, Web & API penetration test, CRITICAL

A digital bank asked us to test the customer application and the APIs behind it. One endpoint served account statements. It checked that the caller was logged in. It never checked that the statement belonged to them.

A policyholder could read and approve claims

Insurance, Web & API penetration test, CRITICAL

A claims portal let policyholders file and track claims. We were asked whether one policyholder could reach another's records, and whether the approval step could be reached from the wrong side.

Path traversal in a managed file transfer platform

Enterprise software, Web & API penetration test, CRITICAL

A managed file transfer product moved contracts, records and financial documents between large organisations. We were asked to test whether the download path could be made to serve a file the caller had no claim to.

SQL injection in a payroll reporting export

HR and payroll software, Web & API penetration test, CRITICAL

A payroll platform held salary, tax and bank details for hundreds of employers. We were asked whether a reporting export could be made to return data the caller was never entitled to.

Tell us about the system in the chat or on the contact page. Yaali, our AI agent, answers first and brings in an engineer.