Application Security
-
Decoding a JWT Is Not the Same as Verifying One
A JSON Web Token is base64 text anyone can read and edit. Trusting its claims without checking the signature and…
Read More » -
The API Vulnerability Scanners Cannot Find: Broken Object Authorization
Changing an ID in a request and receiving someone else's data is the most common serious API flaw. It requires…
Read More » -
Mass Assignment Lets Users Set Fields You Never Exposed
Binding a request body directly to a model means any field in that model is writable, including the ones controlling…
Read More » -
Blocklists Enumerate Badness and Always Miss Something
Filtering known-bad patterns requires anticipating every encoding an attacker might use. Defining what is acceptable requires only knowing your own…
Read More » -
Pre-Commit Secret Scanning Catches What Server-Side Scanning Catches Too Late
By the time a server-side scanner flags a committed secret, it has already left the developer's machine and entered shared…
Read More » -
Shifting Left Failed Because You Shifted the Alerts, Not the Work
Moving security scanning earlier without changing anything else just gives developers thousands of findings they cannot act on. Here is…
Read More » -
An Unverified Webhook Endpoint Accepts Instructions From Anyone
A payment webhook that marks orders paid without verifying the signature will mark orders paid for anyone who finds the…
Read More » -
Concurrent Requests Break Business Rules That Look Airtight
Checking a limit and then acting on it works perfectly in sequence. Fired fifty times simultaneously, the check passes fifty…
Read More » -
SSRF Became Critical When Servers Gained a Metadata Endpoint
A request forgery flaw that once leaked internal pages now reaches a link-local address that hands out cloud credentials.
Read More » -
Dependency Confusion Exploits Which Registry Answers First
If your build tool checks the public registry for an internal package name, anyone can publish that name and have…
Read More »