- Investigate integrating solutions such as Checkmarx or Veracode into your SDLC (for ongoing code level static analysis), do not look just for one-off assessments of your system.

- Run manual penetration tests or vulnerability assessments depending on your confidence in the state of your system. Either choose a pentesting boutique close to you if you like meeting people in person or pick a company that runs tests with a group of people, not a single auditor. The results will likely be much better then.

If you're looking for a solution for team based security testing take a look at http://www.applause.com/security-testing (Disclaimer: I am security team lead at Applause. Disregard that marketing pricing calculator on the webpage)

If you're looking to test any type of app dealing with the protection of digital goods, e.g. Books / DRM / Audio / Video / Paid features, we're specialists for that.

We're deploying teams of white hat security experts to run security tests, including automatic scans on web, mobile, desktop applications.

General process: => Lead security expert carries out risk assessment to craft custom test plan => Penetration test or vulnerability assessment (realtime results in 24/7 web platform) => Deduplicated, validated and prioritized results with remediation advice => Customer fixes vulnerabilites => Retesting of vulnerabilities to verify fixes are effective

First results, often critical vulnerabilities, usually trickle in within minutes of starting the test.

The same type of "attack" can be run against Amazon and most onlineshops that base suggestions on your product viewing / browsing history. So just embed a link to an "interesting" product (e.g. adult toys) in any website and users next visiting amazon will see very odd suggestions. There is not much they can do against this as they still want to count visits on profiles from people coming from Google where the URLs will not hold a valid CSRF token in them.

Only tracking visits when the page UI loaded and preventing the page from being embedded in the iframes via security headers (if only these were supported in a more consistent way) would help address this. Not worth the effort.

This would only become an interesting attack vector if many visits to your profile bumped your credibility in any way.

You register an account on your users' behalf, which might be against the ToS of the startups you interact with - how are you getting around Captchas in the signup process?

Is there a list of supported startups? Do you send an email for every registration that you created or a weekly digest? What if some of the startups have a free trial which expires after the registration? That's potentially a big waste and also against ToS to register a second account to actually try out their services before using upgrading the account with the desired username with a paid plan.

Hmmm - found some answers here: https://earlyclaim.com/disclaimer

You could read up on http://en.wikipedia.org/wiki/Responsible_disclosure

Preferrably contact the vendor directly without publishing your findings online. Give them time to fix the issue. If they do not react and you feel there is a great danger if you do not disclose the existence of this vulnerability, publish it.

Hey there netcorps,

Thanks for the reply. I think that's the way I'll go about it.

Much appreciated!

Google Chrome on Win 7, 64 bit - all pages report "not found". Also behind a companies squid proxy if that might have something to do with it.

Make it work please! It's cool idea, good for showing some design changes without having to change anything in the original page, not even a detection if someone wants to see the new preview etc.

In my case I am also running behind a Squid proxy, maybe it's what's wrong.

Why the limit of 50 keys? I am missing details about how to communicate with testers using your platform.

You do not have a single sreenshot of the interface that the users will see.

Do you allow relabeling of the platform (a subdomain + logo + custom images inside the interface) for the companies corporate design?

I do not know what it will look like to my potential customers, so i would not use your service.

I just signed up as i thought it was interesting, only to find out there is no action in Berlin, Germany. Not really surprised by that.

So i thought, ok, let's set up a group and a diner in a nice restaurant... So why the hell am i supposed to provide my credit card data to potentially pay $22 (??) for a meetup in a UNKNOWN, not freely choosable restaurant in Berlin?

It just tells me "yo, we will set up a nice partner restaurant for you"...

So i have to pay upfront (if enough people signup) for a meetup in a restaurant which i cannot choose, somewhere in Berlin, not knowing if grubwithus will actually be able to book a table in a decent restaurant (how would they know my taste....). It's also entirely unclear how much of the money goes to grubwithus, which should be clearly explained somewhere without me having to look it up in the terms and conditions or wherever it might be hidden.

I'm not fast in saying "This concept will fail", but I am pretty sure this model is fundamentally flawed and will fail...

I misinterpreted the platform as a nice way of setting up a diner with friends + some strangers in a restaurant of my choice (where i know the quality is good), but grubwithus doesn't allow me to do that.

It's also really weird that i cannot comment in my recently created group, because the system tells me to "Slow down there partner!".