--- title: "Dimakatso Sebatane (@ovawatch-security) | Hashnode" description: "Real-World Security Research | Penetration Testing | Offensive Security. Read the latest articles by Dimakatso Sebatane on Hashnode." url: "https://hashnode.com/@ovawatch-security" --- @ovawatch-security # Dimakatso Sebatane @ovawatch-security · Remote · Joined October 2026 Real-World Security Research | Penetration Testing | Offensive Security [Website](https://ovawatch.co.za/) ### [Case Study: Cross-Tenant Data Exfiltration via Backup Restore](https://ovawatch-security.hashnode.dev/case-study-cross-tenant-data-exfiltration-via-backup-restore?utm_source=hashnode&utm_medium=feed) How broken tenant isolation and missing authorization checks in backup restoration can allow attackers to access sensitive data belonging to other organizations. Full video at : https://youtu.be/AshvGLWsclw 9 min read · [ovawatch-security.hashnode.dev](https://ovawatch-security.hashnode.dev/case-study-cross-tenant-data-exfiltration-via-backup-restore?utm_source=hashnode&utm_medium=feed) [Oct 18](https://hashnode.com/posts/case-study-cross-tenant-data-exfiltration-via-backup-restore/6ad6108301bf51809c3a6b0f) ### [Case Study: Pre-Account Takeover via OAuth Misconfiguration](https://ovawatch-security.hashnode.dev/case-study-pre-account-takeover-via-oauth-misconfiguration?utm_source=hashnode&utm_medium=feed) How weaknesses in OAuth account linking and authentication flows can allow attackers to compromise user accounts before legitimate registration. Full video at : https://youtu.be/tDXNoB5-\_2o 12 min read · [ovawatch-security.hashnode.dev](https://ovawatch-security.hashnode.dev/case-study-pre-account-takeover-via-oauth-misconfiguration?utm_source=hashnode&utm_medium=feed) [Oct 10](https://hashnode.com/posts/case-study-pre-account-takeover-via-oauth-misconfiguration/6ad60608308bcb754693225b) ### [Case Study: From HTML Injection to Credential Theft](https://ovawatch-security.hashnode.dev/case-study-from-html-injection-to-credential-theft?utm_source=hashnode&utm_medium=feed) Examining how insufficient HTML sanitization enables credential phishing through attacker-controlled content Full video at https://youtu.be/XDD-hwdWJjY 11 min read · [ovawatch-security.hashnode.dev](https://ovawatch-security.hashnode.dev/case-study-from-html-injection-to-credential-theft?utm_source=hashnode&utm_medium=feed) [Oct 3](https://hashnode.com/posts/case-study-from-html-injection-to-credential-theft/6ad5f939ac782aad2c7b8a5d)