Case studies, release notes, and deep dives into API security scanning.
Introducing ABOM — a cryptographically signed, versioned, diffable manifest of every API route in your codebase. The API equivalent of SBOM, emitted from CI on every deploy. Plus: composite risk scoring (0-100 per route) and ed25519 signing.
read more →How we went from 505 false-positive CRITICAL findings on Mastodon to just 9 — through 7 rounds of adversarial testing and 5 patches. The journey from a noisy scanner to a production-ready tool.
read more →How we built a Grape API parser, expanded Rails concerns, and scanned two of the largest Ruby codebases on earth. 2,449 routes detected in GitLab, 1,017 from Grape alone.
read more →Real-world scan results: 269 routes detected in Ghost CMS, 88% false positive reduction after v0.3.0's AST auth detection. The scan that directly shaped the roadmap.
read more →