Writeups.
Field notes from breaking AI-coded SaaS.

An authorized April 2026 audit of ParakeetAI found a cross-origin account-deletion chain, cross-account transcript injection, server-side request forgery, and a race in free-session creation. The founder engaged promptly; the April findings were remediated before the Q3 re-engagement.

Cossistant is an open-source AI-and-human customer-support framework: an embeddable widget plus an agent dashboard. Its widget API identifies end-users the way Intercom does — you tell it who a visitor is — but unlike Intercom it never asks the customer's backend to prove it. The `identify` call accepts a client-supplied email with no signature, authenticated only by the public key that ships in every page's source. Because a conversation is readable by anyone who shares its contact, an attacker who knows a target's email can attach their own anonymous visitor to that contact and read the target's entire private support history — on any site running Cossistant. Confirmed end-to-end against a throwaway tenant. Disclosed privately on 2026-06-20 through the vendor's own security channel; published under the non-response policy after their stated 48-hour SLA lapsed with no acknowledgement.

Kelviq is a Merchant-of-Record platform for SaaS sellers — it moves money and brokers webhooks on their behalf. Its API returns the full webhook signing secret in plaintext on every list call, lets any logged-in user enumerate the complete seller base through a status-code differential, and serves a 209-endpoint OpenAPI schema plus live Swagger UI from a public, production-routable staging host. None of it is individually Critical; together it is a clean blueprint for forging webhook events and building a platform-wide phishing list. Disclosed privately on 2026-05-21 with a stated publish date; published under the non-response policy after that date passed with no reply.

edgee is a token-compression gateway for coding agents. Its compressor preserves every `<system-reminder>` block in tool output verbatim while summarising everything around it. The check is unanchored — it does not distinguish reminders the agent harness emits (legitimate) from reminders that happen to appear inside a file the agent was asked to read (attacker-controlled). After compression, the attacker's reminder reaches the upstream model 1:1 with its salience amplified 14× in a representative case, and in the Read-tool path it lands in the exact position where Claude Code's harness emits its own reminders. A live test against `claude-opus-4-7` confirmed compliance with a soft injected instruction. Disclosed privately on 2026-05-25; published under the 7-day non-response policy.

A free Skool account was enough to mint a JWT that elevated any user to SUPERADMIN on api.postiz.com and impersonate arbitrary tenants. The same forge primitive separately bypassed billing-enforcement on an unauthenticated public endpoint, and the crypto-payment IPN handler accepted attacker-chosen org_ids to grant lifetime PRO upgrades. Root cause: one JWT secret signed tokens for six distinct purposes with no `aud` claim, and the auth middleware trusted JWT body fields without re-resolving the user from the database. Disclosed via GHSA; fix shipped in 55 minutes; three public advisories — CVE-2026-48781 (Critical), CVE-2026-48783 (Medium), and GHSA-j7rp-5mgj-qgg9 (High) — assigned.

An unauthenticated attacker can hijack a victim's Notion publishing pipeline without ever signing into Outrank. Four findings, two High, sharing one root cause: auth enforced in the app layer but missing from the data tier and several public API routes.