Team Triada

All Research

Every blog post, whitepaper, and research note, in one place.

Client-Side Secret Exposure in Modern SPA/JAMstack Applications

How we found hardcoded signing keys and BaaS credentials in production JS bundles across two separate engagements, and how we triaged them.

Why secret scanning limited to HEAD misses a whole class of long-lived exposure, and the sweep methodology we now run on every engagement.

How we found and confirmed SSRF and brute-force amplification through a decade-old WordPress endpoint during a recent web assessment.