Anukul Dhuriya

Founder & CEO at @vulncure || Security Researcher ||

[Anukul Dhuriya @AnukulHexx]

What is PTaaS? (Penetration Testing as a Service)

Traditional pentesting = test → wait → PDF → repeat

PTaaS = continuous testing + real-time reporting + live collaboration

Instead of waiting 10–12 days for a static report,
Teams

[Anukul Dhuriya @AnukulHexx]

3 out of 10 SaaS apps we pentest have their Stripe secret key exposed in the frontend.

Not the publishable key (pk_live) — that one's meant to be public.

The SECRET key (sk_live). The one that lets you:
→ Issue refunds on any charge
→ Create new charges
→ View every customer's payment history
→ Create and delete customers

How does this happen?

A founder builds a payment flow using an AI tool. The AI puts the payment logic client-side because that's where the UI lives. The secret key gets bundled into the frontend JavaScript.

The app works. Payments process. Everything looks fine. But anyone who opens DevTools → Sources can read the key.

How to check yours right now:
1. Open your app
2. Press F12 (DevTools)
3. Go to the Sources tab
4. Search for "sk_live" or "sk_test"

If you find it — rotate that key in Stripe Dashboard immediately. Then move the payment logic to a backend.

This is the most common critical finding in our pentests. The fix is simple. But you have to know to look.

#pentesting #security #saas #stripe #cybersecurity #vulncure

[Anukul Dhuriya @AnukulHexx]

100% agree. Security isn't binary the biggest mistake is treating it as "pentest or nothing."

Start with the highest-risk areas, increase the depth as your product and customer base grow, and bring in a formal third-party assessment when your exposure and buyer requirements justify it.

My point was mainly to push back against the mindset of, "We'll think about security later."

[Anukul Dhuriya @AnukulHexx]

"We're too early for a pentest?"

I hear this every week. Here's why it's wrong.

You're never too early for security. You're too early for a $25K enterprise pentest — maybe. But you're never too early to know if your customer data is exposed.

The question isn't "can we afford a pentest?"
It's "can we afford a breach?"

Cost of a pentest: $2K–$10K
Cost of a breach:
→ Lost customers
→ Lost enterprise deals (security due diligence is standard now)
→ Lost trust (impossible to rebuild)
→ Legal liability

"But we use Snyk / free scanners"
Scanners find what's known. They miss IDOR, business logic flaws, auth bypass, privilege escalation. These are the bugs that cause real breaches. Scanners don't find them. Humans do.

"We'll do it before launch"
Heard this 100 times. Launch happens. Customers come. Features ship. Security gets pushed. "Before launch" becomes "after launch" becomes "after the breach."

The right time for a pentest:
→ Before your first enterprise deal
→ Before you raise a round
→ Before SOC2
→ Before you have 1000 users

The wrong time:
→ After a breach
→ During due diligence when the investor asks for a report

If you're a SaaS founder and not sure if you're "ready" — you're ready. The finding you don't know about is the one that hurts you.

[Anukul Dhuriya @AnukulHexx]

Most founders don't know the difference between a vulnerability scan and a penetration test.

Here's the simplest way to understand it:

A vulnerability scan is an automated tool that checks your app against a list of known issues. It's fast, cheap, and catches the obvious stuff — missing headers, known CVEs, exposed ports.

A penetration test is a human who thinks like an attacker. They don't just check a list. They explore your app, understand how it works, and try to break it in ways no scanner can predict.

Scanners find what's known.

Pentesters find what's real.

Here's what scanners miss that pentesters catch:

→ IDOR (accessing other users' data)
→ Business logic flaws (manipulating pricing, skipping checkout)
→ Auth bypass (reaching admin routes without logging in)
→ Privilege escalation (a regular user performing admin actions)

These are the bugs that cause real breaches. And they require human reasoning to find.

You need both. Scanners for breadth. Pentests for depth.

But if you can only afford one — get the pentest. The scanner findings are mostly noise. The pentest findings are the ones that actually matter.

#pentesting #cybersecurity #saas #vulnerabilitymanagement #security

[Anukul Dhuriya @AnukulHexx]

We pentested a SaaS last week.

Series A funded. 12 engineers. SOC2 in progress.

Their entire customer database was readable by any logged-in user.

Not through a zero-day. Not through a sophisticated exploit.

Through one API endpoint that returned customer records by ID — without checking if the person requesting them had permission.

User A changes one number in the URL → sees User B's data.

/api/customers/1042 → your data

/api/customers/1041 → someone else's data

2 engineers. Code reviews. SOC2 prep. Nobody caught it.

This is called IDOR. It's the most common vulnerability we find in SaaS apps.

And automated scanners almost never catch it — because the scanner doesn't

know which resources belong to which users.

How to check if you have it:

1. Log in as User A
2. Find a URL with an ID in it
3. Change the ID by +1 or -1
4. If you see data that isn't yours — you have IDOR

The fix is one line of code: add a check that the requesting user owns the resource.

We found this in 30 minutes. It had been live for 8 months.

This is why scanners and human pentests aren't the same thing. Scanners tell

you what might be wrong. A human shows you what IS wrong — and proves it.

#pentesting #security #saas #cybersecurity #soc2

[Anukul Dhuriya @AnukulHexx]

@damian_89_ It's Frustrating

[Anukul Dhuriya @AnukulHexx]

Honored to attend AI Impact Summit. Learned from visionary founders and had meaningful discussions with industry peers and even competitors. Growth happens when the ecosystem grows together.

#AI #AISummit #Innovation #Startups

[Anukul Dhuriya @AnukulHexx]

Demo: https://t.co/4z2lperabc

[Anukul Dhuriya @AnukulHexx]

What is PTaaS? (Penetration Testing as a Service)

Traditional pentesting = test → wait → PDF → repeat

PTaaS = continuous testing + real-time reporting + live collaboration

Instead of waiting 10–12 days for a static report,
Teams

[Anukul Dhuriya @AnukulHexx]

Get vulnerabilities the moment they’re found and can fix them before attackers exploit them.

That’s how security becomes continuous, not episodic.

If you’re building SaaS, fintech, or APIs, PTaaS is the new baseline.

#PTaaS #CyberSecurity #InfoSec #SaaS #Startup

[Anukul Dhuriya @AnukulHexx]

Real-time visibility. Clear ownership. Tracked till closure.

Security shouldn’t wait for testing to end.

👉 See real-time reporting in action
👉 Schedule a call: https://t.co/STTO6TrAPo

#CyberSecurity #PTaaS

[Anukul Dhuriya @AnukulHexx]

It fails because the reporting comes too late.

Traditional pentests:
Test for 10–12 days ➜ then deliver a report.

By the time issues are shared,
Attackers may have already exploited them.

With Vulncure PTaaS:
Vulnerabilities are reported as soon as they’re found.

[Anukul Dhuriya @AnukulHexx]

Schedule a call: https://t.co/STTO6Ts8EW

[Anukul Dhuriya @AnukulHexx]

Security doesn’t fail because teams don’t test.
It fails because issues don’t get owned.

Pen tests show what’s broken.
Real security shows:
• What’s open
• What’s critical
• What’s fixed

All in one place.
Till closure.

That’s how teams move from reports to risk reduction.

[Anukul Dhuriya @AnukulHexx]

Penetration testing alone is not security.

Real security is a loop:
Test → Prioritize → Fix → Track → Repeat

If vulnerabilities aren’t tracked till closure,
You’re not reducing risk
You’re just collecting reports.

👉 Schedule a call: https://t.co/STTO6Ts8EW

#PTaaS

[Anukul Dhuriya @AnukulHexx]

Security should reduce stress - not add to it.

https://t.co/s2ppKibGGN

[Anukul Dhuriya @AnukulHexx]

We built Vulncure PTaaS Dashboard after seeing the same issue repeatedly

Security teams had reports.
Founders had anxiety.
But nobody had clarity.

So we built a single dashboard where:

• Risks are visible
• Severity is clear
• Remediation is trackable

#Vulncure #infosec

[Anukul Dhuriya @AnukulHexx]

I’ve noticed many beginners book demo calls just to learn. That’s not what demos are meant for.

So I created Open Sunday.
Every Sunday, I’m open on Google Meet for 1-on-1 chats to:

• exchange ideas
• guide beginners
• network & learn

DM me “Sunday.” 🤝

[Vulncure @vulncure]

Security is complex enough. Your dashboard shouldn't be.

We stripped away the clutter so you can focus on what actually matters: fixing vulnerabilities fast. ⚡️

[Anukul Dhuriya @AnukulHexx]

Security shouldn’t slow you down.
With the new Vulncure Pentest Dashboard, we’re giving leaders clarity, teams speed & businesses confidence.
Proud of the team for this milestone.
👉 https://t.co/7qsKOS1H4W #ptaas

[Vulncure @vulncure]

🚀 Introducing the Vulncure Penetration Testing Dashboard

Meet Vulncure Pentest Dashboard — the all-in-one platform designed to simplify and supercharge your penetration testing workflow.

In this demo, we’ll walk you through how Vulncure helps you:

• ✨ Streamline your pentests – manage everything from one dashboard

• ⚡ Track vulnerabilities in real time – no more outdated reports

• 📊 Generate professional reports instantly – audit-ready, jargon-free

• 🔐 Centralize asset management – know what’s protected and what’s not

• 📈 View instant security trends – stay ahead of risks across your organization

• 🛡️ Simplify compliance – make audits and testing requests hassle-free

Whether you’re a security leader, compliance officer, or pentester — Vulncure helps you secure smarter, faster, and easier.

👉 Learn more & sign up for a free trial: https://t.co/umW3f9qV1C