Team Triada

Research

CTF postmortems, offensive and defensive write-ups, and vulnerability research from the Team Triada security club.

Client-Side Secret Exposure in Modern SPA/JAMstack Applications

How we found hardcoded signing keys and BaaS credentials in production JS bundles across two separate engagements, and how we triaged them.

Why secret scanning limited to HEAD misses a whole class of long-lived exposure, and the sweep methodology we now run on every engagement.

How we found and confirmed SSRF and brute-force amplification through a decade-old WordPress endpoint during a recent web assessment.