Casco Supervised

Get the best of both worlds. Expert human security engineers and an autonomous pentesting agent.

Schedule a pentestRequest sample pentest report
Cut Delays, Not Quality
Casco Supervised covers OWASP Top 10, OWASP API Top 10, OWASP LLM Top 10, OWASP Cloud Top 10, OWASP Agentic Threat Model, and proprietary threat vectors.
No time wasted on false-positives
Human security engineers from formerly AWS, NSA, and the US Military actively work on every pentest. They verify every finding to reduce false-positives.
Address findings as you go
Get findings as they're discovered. Ask any questions directly in a joint Slack channel, Teams chat, or email threads.
Trusted by
Blaxel
Bloom
Capacitive
Crewai
Daytona
Ground Control
Helix Db
Mesmer
Probo
Scout
Sim
Sixtyfour
The Llm Data Company
Zero Email
Blaxel
Bloom
Capacitive
Crewai
Daytona
Ground Control
Helix Db
Mesmer
Probo
Scout
Sim
Sixtyfour
The Llm Data Company
Zero Email

Work with Expert Pentesters

Casco's forward-deployed offensive security engineers battle-tested their expertise at AWS, NSA, and the US Military.
15
Offensive
Security
Certifications
CISSPCISSPCISSPCISSPCISSPCISSP... and more

FAQs

Schedule a pentest to kick off the process. We need your domain(s) and any test credentials to get started immediately.

Clear findings — what to fix, and why it matters

You get full context, impact, and verification in one clear report.
Star
Improper JWT Verification Leading to Cross-User Data Exposure in AI Claims Chat.
CRITICALCVSS 9.8
iconSummary
The endpoint accepts a client-supplied JWT but does not verify its signature or validate the claim against the authenticated session. An attacker can tamper the field to impersonate another user, causing the backend to fetch and feed that user’s private documents into the LLM, which then leaks sensitive data.
iconImpact
!Unauthorized disclosure of PII, health records, and underwriting notes.
!Violation of data-protection regulations (e.g., HIPAA).
!Significant reputational damage and potential legal liability.
iconReproduction
  1. Obtain a valid JWT for User A.
  2. Decode the JWT payload and change the sub claim to User B’s ID.
  3. Re-encode the token without resigning.
  4. Send a POST to /claims/chat with the modified JWT in Authorization.
  5. Observe that the response (LLM summary) includes User B’s documents—confirming the backend never verified the signature or subject claim.
iconRecommendation
  1. Enforce JWT signature validation on every request using the issuer’s public key.
  2. Ensure the sub claim matches the authenticated user context before data retrieval.
  3. Implement per-user authorization checks on document fetch APIs, rejecting mismatched subjects.
  4. Log and alert on any failed or tampered JWT validations.
Open
Casco logoxOWASP AI Exchange

Proud OWASP sponsors

Gold Sponsor of OWASP AI Exchange to Advance AI Security
Learn more