Industry · SaaS

Security for fast-moving SaaS teams.

Investigate tenant isolation, API authorization, and session handling as your application changes every week.

What's included

acme
/workspace-api
/Vulnerabilities
/WF-0877

High

Sourceroutes/integrations.ts:54

req.body.webhookUrl

Stored on the integration without a host allow-listintegrations.save({ url })services/integrations.ts:29

Loaded when a member presses Send testdeliverTest(integration)webhooks/test.ts:12

Sinkwebhooks/deliver.ts:40

await fetch(integration.url)

Webhook test request reaches the cloud metadata service

HighCVSS 8.6

Weakness: CWE-918 · Server-side request forgery
Confidence: 97
Validation: Exploitable
Proof: 169.254.169.254 answered from the sandbox

Finding · source to sinkIllustrative data

The problem

One missing tenant filter is a breach notice.

Multi-tenant products live or die on isolation. winfunc follows tenant context through requests, services, and data access, and flags the paths where one customer can reach another's data. Several of its public findings are exactly this class of bug.

Included

What winfunc covers.

Multi-tenant isolation investigation grounded in application context
REST, GraphQL, and gRPC authorization review
IDOR and horizontal privilege-escalation investigation
JWT and session-management review
Rate-limiting and abuse-control review
Webhook review covering SSRF, signatures, and replay
Pull-request review as the product ships

Outcomes

What your team walks away with.

Tenant boundaries, traced

winfunc follows tenant context through every relevant path and names the missing filter when it finds one.

API security

Authentication, authorization, input handling, and rate limits are reviewed across every protocol your API speaks.

Security that ships weekly

Pull-request review catches regressions in the change that introduced them.

Answers for enterprise buyers

Reports and evidence help you answer the security questionnaire standing between you and a large deal.

Found by winfunc in open source

All findings

Continue the evaluation

PR security Hypothesis scans Autofix

Start with one repository

Bring us your hardest codebase.
We'll bring the proof.

Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.