X41 D-Sec GmbH

https://infosec.exchange/@x41sec

X41 D-Sec GmbH is an expert provider for application security services. Custom research and a IT security consulting and support services are core competencies of X41 D-Sec GmbH.

Homepage: https://www.x41-dsec.de
Github: https://github.com/x41sec
LinkedIn: https://de.linkedin.com/company/x41

Public Key

npub1a7knlj2daku4ka2rtfs2hlj8tp42yrgg0gp9d3v5ftngwkma03zqvnguxz

NIP-05 Address

x41sec_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqswltfle9x7mw2mw4p45c9tler4s64zp5y85qjkck2y4e58td7hc3qpzfmhxue69uhk7enxvd5xz6tw9ec82cspp4mhxue69uhkummn9ekx7mqpz3mhxue69uhhyetvv9ujuerpd46hxtnfduxztku8

Publishing to

offchain.pub

nos.lol

relay.damus.io

Author Public Key

npub1a7knlj2daku4ka2rtfs2hlj8tp42yrgg0gp9d3v5ftngwkma03zqvnguxz

Show more details

Last Notes

2026-05-28 07:30:41 UTC

There's an update for the Starlette issue: We've scanned thousands of hosts for CVE-2026-48710 and found something important: Being behind a proxy or CloudFlare isn't always a protection unlike previously stated!
When a reverse proxy or CDN (including Cloudflare) sits in front of the target and rejects malformed Host headers, the X-Forwarded-Host header can sometimes be used to bypass the protection! If the backend middleware reads X-Forwarded-Host and updates the ASGI scope, the malicious value can reach the ASGI and Starlette. #badhost

2026-01-21 16:22:13 UTC

After auditing the @npub1xh7…v9hj client applications in 2024, we have recently audited Mullvad VPN's API.
The API is used by clients, partners, and internal services to manage user accounts and parts of the VPN infrastructure.
Five issues were identified, of which only one had a very limited impact on users of the service.
The technical details may be found in our report. https://www.x41-dsec.de/security/research/news/2026/01/20/mullvad/

2025-03-10 12:35:21 UTC

X41 performed an audit of Hickory DNS which is an open source Rust based DNS client, server, and resolver. We were sponsored by the great folks at @npub1c8c…lkhj and supported by @npub1jsv…g5xu
Our full report can be downloaded here: https://x41-dsec.de/security/research/job/news/2025/03/10/hickory-review-2025/

2024-12-11 16:39:26 UTC

X41 Reviewed Mullvad VPN
https://x41-dsec.de/news/2024/12/11/mullvad/
Many thanks to the @npub1xh7…v9hj team for the professional and good interaction during this audit!