Escape CTO: apps can pass DAST scans yet still expose exploitable business-logic flaws
TechNadu · x · 2026-11-05
In a TechNadu expert interview, Escape co-founder and CTO Antoine Carossio explains why an app can pass conventional security tests including DAST scans and still be vulnerable to business-logic attacks.
- Attackers abuse legitimate features in unintended ways, manipulating business processes without tripping any traditional security control.
- Example: an e-commerce app that awards loyalty points on order placement but doesn't reclaim them on cancellation — attackers can place and cancel orders repeatedly to farm rewards for free.
- Every individual API request is valid; no SQL injection or XSS involved. The flaw is in how the application handles the business process as a whole.
- Carossio also discusses how vibe coding challenges traditional pentesting and why continuous AI-driven testing needs strict guardrails.
Related event: Escape CTO: Apps Passing DAST Still Have Exploitable Flaws(2 posts)→
More from coding & agent
- Auto-unsubscribe agent built on Jev: browser-aware email triage cleans inbox in a week — threepointone · 2026-11-05
- Olki ditches LLM-based agent monitoring for strict type systems and effects algebra — bigdata · 2026-11-05
- Alpha School Launches Founders School: Graduate With a Business Doing $1M — nateliason · 2026-11-05
- Why Coda's formula language beats Notion for deterministic agent memory — bfrench · 2026-11-05
- Dev quits 11-year career, vibe-codes AAA-looking sci-fi FPS with AI in 24h, lands Gamescom booth — Aiden_Tech_Ai · 2026-11-05
- JetBrains argues IDEs still matter in the agentic coding era: 'a cockpit, not a typing tool' — Sam_Witteveen · 2026-11-05