Cerebra AI

Overview

Cerebra AI is an AI-powered SaaS platform. The engagement was a grey-box assessment: with partial knowledge of the platform's architecture, I tested the application and its supporting cloud-side surface for injection and access-control weaknesses — and worked the findings into the way the product is built, not just the way it was patched.

Assessment Focus

• Injection vulnerabilities, including SQL injection, across the platform.
• Broken object-level authorisation (BOLA) on API-backed functionality.
• Cloud-side configuration risks supporting the SaaS product.
• SDLC integration: controls that prevent recurrence rather than one-off patches.

Documented Contribution

• Performed in-depth grey-box penetration testing on the AI-powered SaaS platform.
• Uncovered critical vulnerabilities, including SQLi and BOLA.
• Integrated security controls into the SDLC so fixes stick as the product evolves.

Findings & Remediation Summary

Testing revealed critical injection flaws (SQLi) and broken object-level authorisation (BOLA) on the platform. Beyond reporting the findings, security controls were integrated into the client's SDLC — embedding checks into development so the same classes of vulnerability are caught earlier next time. Specific tool assignments, evidence and counts are not published here.