Whitenbaker
Independent Security Research
We find what your last patch left open.
When a security flaw is fixed quietly and shipped with no advisory, the fix rarely closes every door into the same room. We read your shipped code the way an attacker would, find the doors still open, and prove each one against a live copy of your own release. Then we help you close them.
The pattern
A security bug gets fixed in a commit. No CVE, no advisory, no word to the people running the old version. The vendor moves on. But a quiet fix almost never covers every path into the same flaw, and the one it missed is still live in your latest release. We find the fix, find the door it left open, and fire it before someone else does.
What we do
Four ways to put us to work.
Adversarial Code Assessment
Reachable, confirmed flaws in your shipped code, each fired against a live copy of your own release.
Silent-Patch & Forgotten-Door Audit
We follow your undisclosed fixes to the doors they left open, and fire the sibling path the patch never covered.
CNA Advisory Backfill
Every shipped fix mapped to the releases it affected, pinned from your own artifacts, built to the standard a CNA needs.
Continuous Release Watch
Every release audited the day it ships. Live-fired findings, never guesses, before an attacker gets there.
The record
Selected disclosures.
Authentication
Multi-Tenant Authorization Bypass in SuperTokens
CVE-2026-37171, assigned by MITRE
Secrets Management
Webhook Redirect SSRF in Infisical
Submitted, awaiting review
Payments
Hardcoded Admin Credentials in Hyperswitch
Submitted, awaiting review
Why continuous
A silent patch is only deceptive while no one is watching.
With Whitenbaker on continuous watch, every release is checked the day it ships. The quiet fix becomes an open, tracked remediation, and your operators learn what changed before an attacker does.
Proof, not a pitch
See what your last release left open.
Tell us what you ship. We point our own method at your public release and send back one live, reproducible finding, free and with no call. If there is nothing there, we tell you that too.
We also go looking on our own. If you ship software, we may already have one.