Guides, checklists and labs.
The guides and checklists VXSec works from, published in full with no email gate. Want to practise instead of read? Breach Lab has a free hands-on lab.
Guides and checklists
How to test your app for IDOR
Check whether one user can read or change another user's data: a five-minute two-account test, a Supabase RLS check, and the fix.
Sample report
A full findings report, section by section: what was found, the evidence, the fix, and what was approved.
Offboarding gap checklist
What to check when an employee or contractor leaves: accounts, admin roles, shared files, connected apps, tokens, and automations that still carry their name.
Google Workspace access checklist
An access review for Workspace admins: super admins, groups, Shared Drives, external sharing, and third-party app grants.
Microsoft 365 offboarding checklist
The order of operations for a clean Microsoft 365 departure: sign-out, licenses, mailbox, OneDrive, Teams ownership, and app registrations.
OAuth and connected-app review
How to find every app that holds a token to your tenant, decide which ones still deserve it, and revoke the rest without breaking anything.
The switch list
What your apps share about you, and the settings that change it. Free PDF.
Breach Lab: the invoice app
A free 20-minute hands-on lab. Find the hole that shows one customer another company's invoice, prove it, fix it.
Need it done for your business?
VXSec builds, fixes and secures the systems a business runs on. Say what should happen and what happens now, and a written reply with the next step comes back within two business days.
Or see the services