Prince of the Honeycomb - code security

This story begins with a request for an internal penetration test in November of last year: Countercept[1] (F-Secure’s managed Threat Hunting platform) implemented a few new features in Honeycomb (its client-facing Ruby on Rails web application). As it’s good practice, the development team asked for a whitebox penetration test of the newly implemented functionality before releasing it to customers, particularly focused on reviewing some changes to the authentication mechanism.