Security
The URL Fetcher That Read the Metadata Endpoint
The image preview feature fetched whatever URL it was given, so an internal address returned the instance credentials, and the response was rendered back to…
Security
The Debug Endpoint That Was Still Enabled in Production
The route was added for one investigation and guarded by a flag nobody set back, so it served the environment and the stack traces to anyone who guessed the…
Deep Dive
What a Container Actually Isolates, and the Thing It Does Not
The namespaces hide the view and the cgroups cap the usage, and the kernel is shared, so the isolation is a boundary of visibility rather than a wall…
Security
The Rate Limit That Counted Every User as One
The limiter keyed on the connection address, and behind the proxy that address was the load balancer, so the whole office shared one bucket, and one user…
Security
The Password Reset Token That Landed in the Access Log
The token travelled as a query parameter, so the web server logged it, and the log was shipped to a third party, and the token was valid for an hour, and…
Error Autopsy
The Webhook Signature Nobody Verified
The endpoint was public and trusted the body, so a crafted request marked an order as paid, and the fulfilment ran, and the signature header had been…
Security
The Dangling CNAME That Let a Stranger Serve Your Subdomain
The staging bucket was deleted and the DNS record stayed, so anyone could claim the same name and serve content from a hostname on your domain, and the…
Security
The Session Token in localStorage That Outlived the XSS
The token was readable by any script on the origin, so the injection took it and used it from elsewhere, and clearing the cookie would not have mattered…
Security
The JWT That Accepted the none Algorithm
The verifier read the algorithm from the token header and honoured it, so a token signed by nobody was accepted as valid, and the header was the attacker's…
Security
The Open Redirect That Made the Phishing Link Look Legitimate
The login page accepted a return address and sent the user there without checking it, so the attacker's link started with the real domain, passed the user's…
Security
The CORS Wildcard That Was Not Actually Safe
The origin header echoed back whatever the request sent and the credentials flag was on, so any site could read the authenticated response on the user's…
Security
The Training Export That Included Every Tenant's Rows
The dataset query had no tenant filter, so the fine-tuning set contained other customers' records, and the model learned them, and the model answered them…