Subcloak blog

Notes from a security testing practice.

Subcloak tests web apps, APIs and AI agents for teams that ship. Here we write up how access control breaks, how to see what an app or agent really sends, and the free tools we build along the way, such as Cloak Proxy. Real commands, sources checked.

SecurityTesting

Find IDOR bugs from traffic you already captured

Test your own API for IDOR (broken object level authorization) by replaying captured requests as a second user, an admin and no credentials.

20 October 2026 · 11 min read

The Cloak Proxy traffic list with model calls tagged by model name, such as claude-sonnet-5-5 to api.anthropic.com from MyApp, a live SSE stream and a local model call from Terminal. A callout shows a prompt that differs from request 8002's at character 371 of the system prompt, where Today is 2026-10-18 became Today is 2026-10-19.

AI and LLMsDebugging

What did my AI agent actually send? Inspecting LLM calls, tokens, cost and prompt-cache misses

Route your agent's OpenAI, Anthropic or Gemini calls through a local proxy to see each prompt, tokens, estimated cost, time to first token and cache misses.

20 October 2026 · 12 min read

Five name pills, Cloak Proxy, Proxyman, Charles, HTTP Toolkit and mitmproxy, above the Cloak Proxy traffic window listing captured requests from Safari, Google Chrome, curl, MyApp and ShopApp, one of them answered by a Map Local rule

ComparisonsDebugging

Proxyman vs Charles vs HTTP Toolkit vs mitmproxy vs Cloak Proxy (2026)

Five HTTP debugging proxies compared on price, platforms, mocking, scripting, HTTP/3, MCP and CI, with plain advice on when each one is the right pick.

20 October 2026 · 10 min read

Cloak Proxy's Failure Scenarios window with the Flaky checkout scenario on: Checkout fails twice for the CreateOrder GraphQL operation, Time out after 20 s on the payments API only the 2nd time, Cut the body to 50% on /v1/config 30% of the time, and a Trickle at 1 KB/s fault turned off. Below it, the Log tab lists what each fault did to each request.

TestingNetworking

Test how your app handles a flaky network

A checklist of network failures to cause on purpose: retries, timeouts, resets, cut-off bodies, slow or stale responses and expired sessions, locally and in CI.

20 October 2026 · 11 min read

Cloak Proxy's Map Local window with rule folders Checkout, Declined card, Empty cart and Onboarding, rule sets such as Payment declined, and a close-up of a rule's conditions: GraphQL operation is CreateOrder, a JSON body value and an X-App-Version header

iOSMocking

Mock an API response in the iOS Simulator without changing code

Turn a captured request into a mock, edit the JSON, and test 500s, 401s, empty lists, slow responses and single GraphQL operations, then share the mocks with your team.

19 October 2026 · 10 min read

Cloak Proxy's traffic list on a Mac with captured requests to api.example.com, shop.example.com and api.shopapp.example, and a close-up of the iPhone Wi-Fi proxy settings: server 192.168.1.20, port 9090

iOSHTTPS

How to see your iPhone app's network traffic (free, on a Mac)

Capture and decrypt HTTPS from the iOS Simulator or a real iPhone with a free Mac proxy: setup, certificate trust, reading requests, and fixes when traffic hides.

19 October 2026 · 12 min read

Longer studies live in Research, such as the state of MCP scopes. Follow along with the RSS feed.