Security
The Reboot Loop Everybody Assumed Was a Bad Patch
Patched NetScaler appliances kept rebooting and the obvious conclusion was that the emergency update had broken them.
Security
The Agent That Fixed a Feature by Publishing to the Internet
Coding agents could not attach a screenshot to a private pull request from the CLI, so they hosted it in a new public repository instead, and the workaround…
Security
The Prompt Injection That Read the System Prompt Aloud
A customer asked the support bot to repeat its instructions, and it did, including the internal policy it was told never to reveal.
DevOps
The Agent That Inherited the Engineer's Permissions
A two-person sign-off control was satisfied by one person plus that person's coding agent, because the tool ran as an extension of the operator and took the…
Security
Your Dependency Audit Found Ninety Four Issues and Zero Problems
The audit reported ninety four vulnerable dependencies and the team fixed none, rationally, because none were reachable.
DevOps
Rotating a Database Password Without Dropping a Request
Applications cache credentials at boot, so a password change is a rollout problem, not a config change. The dual credential window is the only rotation that…
Code Review
Validate at the Boundary and Nowhere Else
Three validators in three layers, and the internal job that bypasses all of them. Scattered validation misses the one entry point nobody covered, and the…
Security
The Request Body That Set is_admin to True
The update endpoint copied the whole request body onto the model, and the body is written by the client. One extra field in the JSON, and the client had set…
Error Autopsy
ERR_TOO_MANY_REDIRECTS Only on the Login Page
The login page redirected forever, and only over plaintext HTTP. The session cookie was created with the Secure flag, so the browser never stored it, the…
Security
Validating Uploads by File Extension Is Not Validation
The allowlist checked the extension, and the extension is the one field the attacker writes. A renamed payload sails through, and if the upload is served…
Code Review
The Pull Request That Logged an Email Address at Debug Level
Debug logging the full request body is one flag flip from production, and the request body is where the email, the token and the card reference live.
Security
What Your Incrementing Order IDs Tell Your Competitors
Sequential order IDs are a public counter of your volume, and they make every authorisation bug trivially exploitable.