How 7ASecurity Audits Work: Interim Findings + Free Fix Verification (OWASP Director Intro) 7ASecurity 2026-01-22 | What ‘Quality Pentests’ Really Mean: 7ASecurity Interviewed by OWASP Executive Director Andrew van der Stock▶ Need a high-quality pentest or secure code audit?Request a free consultation: 7asecurity.com/#contactThis short clip explains how 7ASecurity audits work—introduced by OWASP Executive Director Andrew van der Stock. Abraham Aranguren (Managing Director, 7ASecurity) covers what “quality” looks like in practice: manual, researcher-led testing (not tool output), interim findings via a dedicated communication channel, actionable reporting with clear replication steps and mitigation guidance, and free fix verification so issues are actually resolved.▶ See examples of our work (public reports & research):7asecurity.com/publications▶ Security training (online, private, and public courses):7asecurity.com/trainingStore: store.7asecurity.com7ASecurity is ISO 27001 and SOC 2 certified and an OWASP Platinum Corporate Supporter.CHAPTERS00:00 OWASP Executive Director intro00:28 What 7ASecurity does + certifications01:03 Trusted by open-source and media organizations02:16 Public reports and open-source audit work02:46 What a “real” report includes (validated findings, replication steps, remediation)04:15 Dedicated comms channel + interim findings during the audit05:42 Free fix verification + quality guarantee06:12 ClosingABOUT 7ASECURITY7ASecurity is an ISO27001 and SOC2 certified cybersecurity consultancy and OWASP Platinum Supporter specializing in manual, high-quality penetration tests and secure code audits. Trusted since 2011 by the Linux Foundation, Mozilla Foundation, Tor Project, The Guardian, and many others (7asecurity.com/publications). Every engagement is tailored to the client priorities and threat model, and guided through a dedicated channel from scoping to free fix verification. With researcher-led testing that outperforms automation, 7ASecurity consistently uncovers vulnerabilities others miss — delivering real results with proof and replication steps, clear guidance, and measurable security improvements that stand up to real-world threats.Request a free consultation today: 7asecurity.com/#contact#OWASP #AppSec #PenTest #CodeAudit #CyberSecurity #SecureCodeReview
7ASecurity Interviewed by OWASP Executive Director Andrew van der Stock (Full Interview) 7ASecurity 2026-01-18 | What ‘Quality Pentests’ Really Mean: 7ASecurity Interviewed by OWASP Executive Director Andrew van der Stock▶ Need a high-quality pentest or secure code audit?Request a free consultation: 7asecurity.com/#contactIn this full interview, OWASP Executive Director Andrew van der Stock speaks with Abraham Aranguren (Managing Director, 7ASecurity) about what “high-quality” security testing really looks like: threat-model driven scoping, researcher-led testing, actionable reporting with clear replication steps and mitigation guidance, and free fix verification.▶ See examples of our work (public reports & research):7asecurity.com/publications▶ Security training (online, private, and public courses):7asecurity.com/trainingStore: store.7asecurity.comKEY TOPICS COVERED- Manual pentesting vs. checkbox/automated audits- Tailoring scope to a client’s threat model and priorities- Dedicated comms channel during the engagement- Free fix verification + quality standards- OWASP resources used in real remediation guidance (Cheat Sheets, Testing Guide, ASVS)- Open-source security audits and transparency- AI tooling as augmentation (validate before you report)CHAPTERS0:00 OWASP Intro0:35 What 7ASecurity does (pentests, code audits, AI testing, cloud, etc.)1:11 Public pentest reports & open-source work5:16 Why communication during a pentest matters7:06 Free fix verification + quality guarantee8:54 OWASP OWTF and balancing automation with human validation18:52 AI in security work (augment, don’t replace)34:17 Why repeated pentesting reduces severity over time36:11 Business logic & authorization flaws37:35 Career advice for new pentesters47:33 Wrap-up + OWASP 25th anniversaryABOUT 7ASECURITY7ASecurity is an ISO27001 and SOC2 certified cybersecurity consultancy and OWASP Platinum Supporter specializing in manual, high-quality penetration tests and secure code audits. Trusted since 2011 by the Linux Foundation, Mozilla Foundation, Tor Project, The Guardian, and many others (7asecurity.com/publications). Every engagement is tailored to the client priorities and threat model, and guided through a dedicated channel from scoping to free fix verification. With researcher-led testing that outperforms automation, 7ASecurity consistently uncovers vulnerabilities others miss — delivering real results with proof and replication steps, clear guidance, and measurable security improvements that stand up to real-world threats.Request a free consultation today: 7asecurity.com/#contact#OWASP #AppSec #PenTest #CodeAudit #CyberSecurity #SecureCodeReview
Why do you need a pentest? 7ASecurity 2024-01-29 | Video presentation on our recent appearance at The Security Repo podcast, with interesting points and comments from the hosts: Mackenzie Jackson and Dwayne McDaniel:🛡️ Discover 14 compelling reasons why opting for a manual pentest performed by humans is indispensable in safeguarding your digital assets, as well as other interesting topics.1000 off your next pentest → code: SECREPO1000sales@7asecurity.com / 7asecurity.com/#contact Public pentest reports → 7asecurity.com/publications 40% off any training course → code: SECREPO40store.7asecurity.com/discount/SECREPO40 Free workshops → 7asecurity.com/freeLinks to The Security Repo podcast:podcasts.apple.com/us/podcast/the-security-repo/id1634401017open.spotify.com/show/2emgX3m3dJSzlmAG3axBGa
XMPP MitM via PLAIN mechanism 7ASecurity 2023-06-08 | Are you testing MitM of an old protocol that starts using clear-text communications?You should consider spoofing server replies with some downgrade attack.This old trick still works sometimes against protocols like:XMPP, SMTP, POP3 and othersLet's illustrate this with an XMPP example from the field :)Get a FREE 4h workshop now! 7asecurity.com/free-workshop-mobile-practicalIncludes:• 4h Video recording• Vulnerable apps to practice• Guided exercise PDF• Lifetime accessMore free stuff: 7asecurity.com/freeGet 10% off any course: store.7asecurity.com/discount/YOUTUBE10Store: store.7asecurity.comWebsite: 7asecurity.comUpcoming training: 7asecurity.com/trainingFollow us:Twitter: twitter.com/7aSecurityLinkedIn: linkedin.com/company/19059590LinkedIn: linkedin.com/in/abrahamarangurenHelp the channel grow with a Like, Comment, & Subscribe!
LeaveHomeSafe 3.3.0 Retest 2022-07-29: Part 03 - COVID Status Access via Auth Bypass (High) 7ASecurity 2022-07-29 | LeaveHomeSafe 3.3.0 Retest 2022-07-29: Part 03 - LHS-01-008 WP1 COVID Status Access via Auth Bypass (High)This video series introduces the app "LeaveHomeSafe", the privacy and security concerns surrounding it and the Audit performed by 7ASecurity on behalf of Hong Kong Democracy Council (HKDC) & Open Technology Fund (OTF).Check the complete playlist here: youtube.com/playlist?list=PLvZRXGYanejRYboVq4jZQ4dygDVVSPB-HHong Kong Democracy Council (HKDC) - hkdc.usOpen Technology Fund - https://www.opentech.fund/news/7asecurity-otf-red-team-lab-partner-completes-blackbox-pentest-and-privacy-audit-of-leavehomesafe-app/7ASec blog post - 7asecurity.com/blog/2022/07/leavehomesafe-android-ios-apps7asec tweet - twitter.com/7aSecurity/status/15526138478691491847ASec audit report - 7asecurity.com/reports/pentest-report-leavehomesafe.pdfHong Kong government's response - https://www.info.gov.hk/gia/general/202207/28/P2022072800632.htm--------------------------------------------------------------------------------------------------------------------------These issues are true, try them on your own to confirm :)Download LeaveHomeSafe 3.3.0 for Android: play.google.com/store/apps/details?id=hk.gov.ogcio.leavehomesafe&hl=en&gl=USdrive.google.com/file/d/1Uo31qvwNN3E1R8m19X2w6ZNEUy8QCmZo/view Download LeaveHomeSafe 3.3.0 for iOS:apps.apple.com/us/app/leavehomesafe/id1536377801drive.google.com/file/d/10FSDx5nRKsi9zhOJeE2dwhAM5nxIpgQM/view
LeaveHomeSafe 3.3.0 Retest 2022-07-29: Part 02 - MitM via invalid TLS Certificates (Critical) 7ASecurity 2022-07-29 | LeaveHomeSafe 3.3.0 Retest 2022-07-29: Part 02 - LHS-01-001 WP1 MitM via invalid TLS Certificates (Critical)This video series introduces the app "LeaveHomeSafe", the privacy and security concerns surrounding it and the Audit performed by 7ASecurity on behalf of Hong Kong Democracy Council (HKDC) & Open Technology Fund (OTF).Check the complete playlist here: youtube.com/playlist?list=PLvZRXGYanejRYboVq4jZQ4dygDVVSPB-HHong Kong Democracy Council (HKDC) - hkdc.usOpen Technology Fund - https://www.opentech.fund/news/7asecurity-otf-red-team-lab-partner-completes-blackbox-pentest-and-privacy-audit-of-leavehomesafe-app/7ASec blog post - 7asecurity.com/blog/2022/07/leavehomesafe-android-ios-apps7asec tweet - twitter.com/7aSecurity/status/15526138478691491847ASec audit report - 7asecurity.com/reports/pentest-report-leavehomesafe.pdfHong Kong government's response - https://www.info.gov.hk/gia/general/202207/28/P2022072800632.htm--------------------------------------------------------------------------------------------------------------------------These issues are true, try them on your own to confirm :)Download LeaveHomeSafe 3.3.0 for Android: play.google.com/store/apps/details?id=hk.gov.ogcio.leavehomesafe&hl=en&gl=USdrive.google.com/file/d/1Uo31qvwNN3E1R8m19X2w6ZNEUy8QCmZo/view Download LeaveHomeSafe 3.3.0 for iOS:apps.apple.com/us/app/leavehomesafe/id1536377801drive.google.com/file/d/10FSDx5nRKsi9zhOJeE2dwhAM5nxIpgQM/view
LeaveHomeSafe 3.3.0 Retest 2022-07-29: Part 01 - Intro 7ASecurity 2022-07-29 | LeaveHomeSafe 3.3.0 Retest 2022-07-29: Part 01 - IntroductionPart 1 of this video series introduces the app "LeaveHomeSafe", the privacy and security concerns surrounding it and the Audit performed by 7ASecurity on behalf of Hong Kong Democracy Council (HKDC) & Open Technology Fund (OTF).Check the complete playlist here: youtube.com/playlist?list=PLvZRXGYanejRYboVq4jZQ4dygDVVSPB-HHong Kong Democracy Council (HKDC) - hkdc.usOpen Technology Fund - https://www.opentech.fund/news/7asecurity-otf-red-team-lab-partner-completes-blackbox-pentest-and-privacy-audit-of-leavehomesafe-app/7ASec blog post - 7asecurity.com/blog/2022/07/leavehomesafe-android-ios-apps7asec tweet - twitter.com/7aSecurity/status/15526138478691491847ASec audit report - 7asecurity.com/reports/pentest-report-leavehomesafe.pdfHong Kong government's response - https://www.info.gov.hk/gia/general/202207/28/P2022072800632.htm--------------------------------------------------------------------------------------------------------------------------These issues are true, try them on your own to confirm :)Download LeaveHomeSafe 3.3.0 for Android: play.google.com/store/apps/details?id=hk.gov.ogcio.leavehomesafe&hl=en&gl=USdrive.google.com/file/d/1Uo31qvwNN3E1R8m19X2w6ZNEUy8QCmZo/view Download LeaveHomeSafe 3.3.0 for iOS:apps.apple.com/us/app/leavehomesafe/id1536377801drive.google.com/file/d/10FSDx5nRKsi9zhOJeE2dwhAM5nxIpgQM/view
Hacking JavaScript Desktop apps with XSS and RCE - Live stream with John Hammond 7ASecurity 2022-05-30 | The workshop focuses on Electron but the techniques covered will be helpful against other desktop platforms, as well as CSP bypasses and other web security techniques.Get a Free taste of 7ASecurity workshops here: 7asecurity.com/freeCheck out our self-paced courses: store.7asecurity.com/discount/YOUTUBEFollow us on Twitter: twitter.com/7aSecurity
How to find your personal discount and referral link 7ASecurity 2021-01-21 | This video explains how to find and use your personal discount code code from our training portal.You can get many nice workshops for free or also use this discount if you want to buy anything:store.7asecurity.com/discount/YOUTUBEI hope this helps, as we got some questions about this :)
Cyber4All Webinar: Hacking Web apps with RCE and Prototype Pollution 7ASecurity 2020-12-09 | Email admin@7asecurity.com for free access to all apps and slides covered in this webinar, practice these exercises at your own pace.Get 25% off any course:store.7asecurity.com/discount/NY25
Practical Mobile app attacks by Example Workshop - OWASP Czech Day 7ASecurity 2020-12-02 | For full access to workshop materials: Vulnerable apps, slides, recording and future updates, please email admin@7asecurity.com.Check out our self-paced courses:store.7asecurity.com/discount/YOUTUBE
Hacking Modern Desktop apps with XSS and RCE Workshop 7ASecurity 2020-11-17 | Email admin@7asecurity.com for lifetime access to all apps used in this workshop, slides, recording and more.For self-paced courses please see:store.7asecurity.com/discount/YOUTUBE
Practical Mobile app Attacks by Example Workshop 7ASecurity 2020-11-10 | Ping admin@7asecurity.com for access to workshop materials!Interested in our courses? Use this discount:store.7asecurity.com/discount/YOUTUBE
Hacking Android, iOS and IoT apps by Example 7ASecurity 2020-06-03 | Training Teaser video for one of our courses:Hacking Android, iOS and IoT apps by ExampleJuly 20-22 (3 days) HITB, Singapore [ Online ]conference.hitb.org/hitbsecconf2020sin/sessions/3-day-training-4-hacking-android-ios-and-iot-apps-by-exampleFor other locations, please see:7asecurity.com/training#public
Hacking Modern Web & Desktop apps: Master the Future of Attack Vectors 7ASecurity 2020-03-02 | Training Teaser video for one of our courses:Hacking Modern Web & Desktop apps: Master the Future of Attack VectorsAugust 1-4 (4 days) BlackHat, Las Vegas, USA [ Online ]blackhat.com/us-20/training/schedule/index.html#advanced-pwning--fixing-of-nodejs--electron-apps-shells-injections-and-fun-19047For other locations, please see:7asecurity.com/training#public
