Field notes
Case studies, hardening guides and compliance explainers from Sumrite penetration testers. No scanner dumps.
What to test in an Android or iOS app, mapped to the eight OWASP MASVS control groups, plus how to scope a mobile pentest and what a useful report includes.
By Faisal Khan4 min read
The server: awselb/2.0 header tells attackers what you run. One listener attribute removes it. Console, CLI and Terraform steps.
By Niyaz Khan3 min read
What NCA's Cloud Cybersecurity Controls expect from cloud providers and tenants in Saudi Arabia: what to test, who tests what, and the evidence auditors ask for.
By Niyaz Khan4 min read
What a SaaS company needs from web application VAPT: scope, OWASP coverage, a scorecard for choosing a provider, deliverables, and how Sumrite runs it.
By Faisal Khan9 min read
The DPDP Rules 2025 phase in to May 2027. The deadlines, what Rule 6 security safeguards and Rule 7 breach reporting require, and a checklist to work through.
By Nishant Sharma4 min read
Who must do VAPT under SEBI's CSCRF, how often by category, why the auditor must be CERT-In empanelled, and the closure and revalidation deadlines.
By Nishant Sharma5 min read
Enterprise buyers ask for a recent penetration test. Here is what SaaS startups should test, when, and what the report needs to show.
By Faisal Khan2 min read
Who actually requires a CERT-In empanelled auditor, what empanelment means, what the audit report must show and how to check a provider before you sign.
By Faisal Khan5 min read
What AWS, Microsoft and Google actually allow, what gets you in trouble, and where cloud pentests find the issues that matter: identity, storage and exposed services.
By Niyaz Khan5 min read
India's Digital Personal Data Protection Act and Rules in plain English: who is covered, consent, security safeguards, breach reporting, deadlines and penalties.
By Nishant Sharma7 min read
If an app builds a redirect from the Host header, an attacker who changes that header can send users to their own domain. How it happens and how to fix it.
By Niyaz Khan5 min read
A food-tech SaaS used sequential IDs in their API. One loop, all 12,000 records. How we found it, and what it cost the business.
By Faisal Khan5 min read
Talk to a tester
Scoped quote within a day. Expert-led testing, verified findings, a fix-and-retest cycle and a report your auditors can use as evidence.