---
title: "Excession Labs (@excessionlabs) | Hashnode"
description: "Excession Labs is a security lab. We run authorized penetration tests and AI red teaming for web apps, APIs and AI products."
url: "https://hashnode.com/@excessionlabs"
---

@excessionlabs

# Excession Labs

@excessionlabs · Joined November 2026

Excession Labs is a security lab. We run authorized penetration tests and AI red teaming for web apps, APIs and AI products.

### [PKCE: testing authorization code interception locally](https://excessionlabs.hashnode.dev/pkce-testing-authorization-code-interception-locally?utm_source=hashnode&utm_medium=feed)

PKCE: testing authorization code interception locally PKCE (Proof Key for Code Exchange, RFC 7636) makes a stolen authorization code useless on its own. In our local toy server without PKCE, a party h

10 min read · [excessionlabs.hashnode.dev](https://excessionlabs.hashnode.dev/pkce-testing-authorization-code-interception-locally?utm_source=hashnode&utm_medium=feed)

[1h ago](https://hashnode.com/posts/pkce-testing-authorization-code-interception-locally/6af4c7eaa6ece761d6fa3946)

### [Row level security: three Postgres mistakes, tested](https://excessionlabs.hashnode.dev/row-level-security-three-postgres-mistakes-tested?utm_source=hashnode&utm_medium=feed)

Row level security: three Postgres mistakes, tested Row level security (RLS) is a PostgreSQL feature that limits which table rows each role can read or write, based on policies. In a throwaway Postgre

9 min read · [excessionlabs.hashnode.dev](https://excessionlabs.hashnode.dev/row-level-security-three-postgres-mistakes-tested?utm_source=hashnode&utm_medium=feed)

[2](https://hashnode.com/posts/row-level-security-three-postgres-mistakes-tested/6af3c2527ca091ae936c9627) [19h ago](https://hashnode.com/posts/row-level-security-three-postgres-mistakes-tested/6af3c2527ca091ae936c9627)

### [GraphQL introspection: disabling it leaves the field open](https://excessionlabs.hashnode.dev/graphql-introspection-disabling-it-leaves-the-field-open?utm_source=hashnode&utm_medium=feed)

GraphQL introspection: disabling it leaves the field open GraphQL introspection lets a client ask the server for its whole schema. Turning it off hides the field list, but a client that knows or guess

9 min read · [excessionlabs.hashnode.dev](https://excessionlabs.hashnode.dev/graphql-introspection-disabling-it-leaves-the-field-open?utm_source=hashnode&utm_medium=feed)

[19h ago](https://hashnode.com/posts/graphql-introspection-disabling-it-leaves-the-field-open/6af3c1fede442c2445ddd0fa)

### [SSRF: reproduce, bypass, and fix a preview endpoint](https://excessionlabs.hashnode.dev/ssrf-reproduce-bypass-and-fix-a-preview-endpoint?utm_source=hashnode&utm_medium=feed)

SSRF: reproduce, bypass, and fix a preview endpoint Server-side request forgery (SSRF) is a flaw where a server fetches a URL chosen by the caller, so the caller can reach hosts that only the server c

9 min read · [excessionlabs.hashnode.dev](https://excessionlabs.hashnode.dev/ssrf-reproduce-bypass-and-fix-a-preview-endpoint?utm_source=hashnode&utm_medium=feed)

[19h ago](https://hashnode.com/posts/ssrf-reproduce-bypass-and-fix-a-preview-endpoint/6af3c19ec86ae5551bad0419)