{"id":51,"date":"2026-09-04T10:30:08","date_gmt":"2026-09-04T10:30:08","guid":{"rendered":"https:\/\/preview.deltatheme.com\/kiln\/2026\/09\/04\/why-your-scanner-said-clean-and-we-didnt\/"},"modified":"2026-09-04T21:08:57","modified_gmt":"2026-09-04T21:08:57","slug":"why-your-scanner-said-clean-and-we-didnt","status":"publish","type":"post","link":"https:\/\/preview.deltatheme.com\/kiln\/2026\/09\/04\/why-your-scanner-said-clean-and-we-didnt\/","title":{"rendered":"Why your scanner said clean and we did not"},"content":{"rendered":"<p>The scan was clean because the scanner asked the questions it knows how to ask. It checked versions, it checked headers, it checked for the vulnerabilities that have names.<\/p>\n<p>We got in through a password reset flow that leaked whether an address existed, an enumeration endpoint with no rate limit, and a support tool that trusted a header the load balancer did not strip. None of those three is a vulnerability on its own. Together they are an account takeover.<\/p>\n<p>A scanner finds vulnerabilities. An operator finds paths.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Three findings that are nothing on their own, and an account takeover when you chain them.<\/p>\n","protected":false},"author":2,"featured_media":93,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-51","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"delta":null,"_links":{"self":[{"href":"https:\/\/preview.deltatheme.com\/kiln\/wp-json\/wp\/v2\/posts\/51","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/preview.deltatheme.com\/kiln\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/preview.deltatheme.com\/kiln\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/preview.deltatheme.com\/kiln\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/preview.deltatheme.com\/kiln\/wp-json\/wp\/v2\/comments?post=51"}],"version-history":[{"count":1,"href":"https:\/\/preview.deltatheme.com\/kiln\/wp-json\/wp\/v2\/posts\/51\/revisions"}],"predecessor-version":[{"id":120,"href":"https:\/\/preview.deltatheme.com\/kiln\/wp-json\/wp\/v2\/posts\/51\/revisions\/120"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/preview.deltatheme.com\/kiln\/wp-json\/wp\/v2\/media\/93"}],"wp:attachment":[{"href":"https:\/\/preview.deltatheme.com\/kiln\/wp-json\/wp\/v2\/media?parent=51"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/preview.deltatheme.com\/kiln\/wp-json\/wp\/v2\/categories?post=51"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/preview.deltatheme.com\/kiln\/wp-json\/wp\/v2\/tags?post=51"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}