BoxSight · Capability Brief

We audit the rulebook your software is built on.

Internet standards contain ambiguities that make different implementations disagree on the same input. Those disagreements are security holes — and almost nobody is looking for them.

The blind spot

Your team tests its code. Your scanners check your dependencies. But the written standards your software implements — the documents that define how login tokens work, how encrypted connections are set up, how APIs talk to each other — are treated as settled ground. They aren't. They're written in natural language, and where the language is ambiguous, different vendors quietly build the same clause differently. Think of it as a contract written in slightly vague language: two companies read the same clause and build different things. When one of those things is more permissive than the other, an attacker walks through the gap.

Same input to every implementation One authentication token identical bytes, sent to five different libraries Library A reads the clause permissively Library B strict Library C strict Library D strict Library E strict ACCEPTS (vulnerable) REJECTS (safe) REJECTS (safe) REJECTS (safe) REJECTS (safe) the gap All five are technically conformant with the standard — the bug isn't in any one codebase. It's in the disagreement between them. That gap is the security hole.
The same input. Different software. One reads the standard more permissively — and the gap between them is where attackers get in. No code scanner finds this, because the flaw isn't inside any single codebase.

Why existing tools miss this

Static analysis, dependency scanning, and fuzzing all assume the bug lives inside one codebase. This one doesn't. The flaw lives in the gap between implementations — when your library and your counterparty's library both look correct in isolation but interpret the same standard differently. Finding it requires testing the standard itself: giving the same input to multiple real-world libraries and watching for who agrees with whom.

The proof — a real vulnerability, end to end

A method we built (HUNTER) found exactly this kind of flaw in PyJWT — a Python library used by millions of services to verify login tokens. Here is how the finding worked, step by step:

Step 1 · The standard is silent The JWT standard says a token can include a URL to fetch a verification key It says nothing about which URL types (http, https, file, ftp…) are allowed Step 2 · We test five libraries with a crafted input key URL set to: file:///etc/passwd (a local system file, not a web address) Step 3 · Four refuse, one reads the file PyJWT reads the local file Python · urllib accepts file:// by default 4 libraries refuse the file:// URL panva/jose · golang-jwt · MS IdentityModel · Spring/Nimbus PyJWT tries to use the file's contents as a cryptographic key — an attacker who controls the token can read any local file from the server Step 4 · Confirmed and fixed CVE-2026-48522 · maintainer confirmed · fixed in PyJWT 2.13.0 · May 2026
A real finding, end to end. The standard was silent on which URL types to allow; one library inherited a permissive default; the others didn't. The maintainers confirmed and fixed the bug. That finding came from testing the standard, not the code.

That vulnerability had been sitting in a widely-used library, undetected by any code scanner, because it wasn't a bug in the code — it was a gap between how five libraries interpreted the same standard. This isn't a one-off. The same kind of cross-implementation disagreement turns up repeatedly across the protocols we've tested — wherever a standard leaves room for interpretation.

What you get

A targeted audit of the standards your product relies on.

1 Audit your standards auth · TLS · APIs 2 Test against real implementations multiple vendors, same input 3 Confirmed findings only no false-alarm noise 4 Actionable report + disclosure support We report what's genuinely there — the method's negative results are as trustworthy as its findings.

Built for teams shipping software on authentication, identity, cryptographic, or protocol standards — and for security teams that have exhausted code-level scanning and want to look at the layer underneath.

If your product depends on internet standards, the standards themselves are an attack surface.

Engage BoxSight for a targeted audit of the standards your product relies on. We'll tell you which parts are exposed.

Start a conversation →

Keijo Tuominen · keijo@boxsight.ai · boxsight.ai
Read the full technical paper → for methodology, case studies, and the complete empirical record.