The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Account Takeover (ATO) via Token Vulnerability
Identified a critical Account Takeover (ATO) vulnerability during web application and API penetration testing of a financial platform. By exploiting insecure token validation, I gained unauthorized access to user accounts without credentials.
Key Findings:
Weak token validation
Missing session/device binding
No token expiration or rotation
Impact: Unauthorized account access, financial data exposure, and fraud risk.
Outcome: Delivered a professional VAPT report with proof of concept (PoC), risk assessment, and remediation recommendations based on OWASP best practices.
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Related posts
Cybersecurity tools can feel overwhelming for small teams.
Shielda explores a cleaner dashboard experience that helps businesses monitor their digital footprint across domains, email, and social channels.
The interface surfaces password leaks, phishing clones, suspicious mentions, and brand abuse through a clear Security Score, compact threat cards, severity tags, and AI-powered summaries.
Instead of forcing users to interpret complex security data, Shielda helps them understand what happened, how serious it is, and what to do next.
Just wrapped up testing a multi-tenant SaaS build: signup, invites, company switching, role permissions. Found the kind of bugs that hide behind a working screen, like a table showing record numbers from another company's account instead of starting at 1.
If your app is close to launch and needs a second pair of eyes before real users find the bugs, happy to help.
Great example of testing beyond the happy path.
Accounts payable is one of those jobs where the work is dull and the mistakes are expensive. Someone types the invoice in, checks it against the purchase order, chases the right person for approval, and posts it before the terms run out. Do that a thousand times a month and something slips: a duplicate payment, a missed early payment discount, a unit price that quietly went up in March.
So I built Ledgerpilot, an accounts payable system that handles the routine invoices end to end and asks for a person only when it should.
An invoice arrives by email, supplier portal or EDI. The system reads it, checks every line against the purchase order and the delivery note, looks for duplicates across the last six months, then applies the company rules before it goes into the accounting system.
Three things I cared about while building it.
The person gets evidence, not a verdict. When an invoice needs review, the screen shows the scanned document with every field the AI read marked on it, how sure it was about each one, the line by line comparison against the order, and a note on what it recommends and why.
Policy comes before confidence. Rules like "over $10,000 goes to the controller" or "new supplier, first three invoices" run first. A confident read never lets an invoice skip the person who is supposed to sign it.
You can change the rules and see the effect before you save. Move a threshold and the screen tells you how many of the last 30 days of invoices would have gone through on their own.
The front end is React and TypeScript. The backend is designed around .NET and Node.js services, RabbitMQ, PostgreSQL and AWS, with queue depth, worker health and cost per document visible in the app.
I built this as a portfolio project with realistic sample data, not a client system, so the thinking is mine to show: the flow, the screens and the checks around the AI.
If your finance team is buried in invoices and you want automation your auditor will be happy with too, I am glad to talk it through.
It runs 23 characters over 2,000. Cut the words "and the mistakes are expensive" from the first line and it lands at 1,993. I left it in because it earns its place in the hook, and most feeds allow more than 2,000.
