Penetration testing case studies, hardening guides and compliance explainers from Summit.https://sumrite.com/enhttps://sumrite.com/blog/cors-misconfiguration-reflected-origin/https://sumrite.com/blog/cors-misconfiguration-reflected-origin/Fix a CORS misconfiguration where Access-Control-Allow-Origin reflects any Origin, such as evil.com. Risk rating, safe tests and secure configs for every stack.Tue, 06 Oct 2026 00:00:00 GMTSecurity HardeningCORSAPI SecuritySecurity HeadersWeb Application SecurityHardeninghttps://sumrite.com/blog/remove-iis-server-header/https://sumrite.com/blog/remove-iis-server-header/Remove the IIS Server header (Microsoft-IIS/10.0) and Microsoft-HTTPAPI/2.0 from HTTP.sys, plus X-Powered-By and X-AspNet-Version, on every IIS version.Tue, 06 Oct 2026 00:00:00 GMTSecurity HardeningIISWindows ServerSecurity HeadersInformation DisclosureHardeninghttps://sumrite.com/blog/secure-cookie-flags-samesite/https://sumrite.com/blog/secure-cookie-flags-samesite/Secure cookie flags explained: Secure, HttpOnly and SameSite Strict vs Lax vs None, which to pick for each cookie, and how to set them in every major framework.Tue, 06 Oct 2026 00:00:00 GMTSecurity HardeningCookiesSession ManagementCSRFSecurity HeadersHardeninghttps://sumrite.com/blog/disable-aws-alb-server-header/https://sumrite.com/blog/disable-aws-alb-server-header/Remove the AWS ALB server header (awselb/2.0) with the routing.http.response.server.enabled listener attribute: console, CLI and Terraform steps.Sat, 14 Mar 2026 00:00:00 GMTSecurity HardeningAWSALBSecurity HeadersInformation DisclosureHardeninghttps://sumrite.com/blog/how-idor-exposed-customer-records/https://sumrite.com/blog/how-idor-exposed-customer-records/IDOR vulnerability case study: sequential IDs in a SaaS API let a competitor download 12,000 customer records. How it was found, exploited and fixed in 4 hours.Sat, 14 Mar 2026 00:00:00 GMTCase StudiesIDOROWASP API1Access ControlSaaS SecurityAPI Security