Excession Labs is a security lab. We run authorized penetration tests and AI red teaming for web apps, APIs and AI products.
Penetration testing cost in 2026: 68 published prices from 21 providers Penetration testing cost is what a provider charges to test a system for security flaws, and it is usually priced per test, per
PKCE: testing authorization code interception locally PKCE (Proof Key for Code Exchange, RFC 7636) makes a stolen authorization code useless on its own. In our local toy server without PKCE, a party h
Row level security: three Postgres mistakes, tested Row level security (RLS) is a PostgreSQL feature that limits which table rows each role can read or write, based on policies. In a throwaway Postgre
GraphQL introspection: disabling it leaves the field open GraphQL introspection lets a client ask the server for its whole schema. Turning it off hides the field list, but a client that knows or guess
SSRF: reproduce, bypass, and fix a preview endpoint Server-side request forgery (SSRF) is a flaw where a server fetches a URL chosen by the caller, so the caller can reach hosts that only the server c
