Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Sort
47 posts ← reset filters
SecurityThe Certificate Row Is Not the Certificate: A Revocation Bypass in Lemur
A newly disclosed Lemur flaw lets a low-privileged user create a duplicate certificate record and use it to revoke the real certificate at its issuing CA. The problem is a subtle but serious authorization mistake: trusting local row ownership instead of the CA-side certificate identity.
Aug 19, 2026 · 9 min
SecurityOne SSRF Control Is Not Enough: The Budibase Automation Bypass
A newly disclosed Budibase SSRF issue shows why outbound HTTP protection cannot live in one integration while automation steps call fetch directly. The real failure is architectural: security controls that are opt-in, inconsistent, and easy for new features to bypass.
Aug 15, 2026 · 9 min
SecurityA Leaked Cookie Signing Key Is an Auth Failure, Not a Configuration Bug
CVE-2026-72793 exposes sensitive SiYuan configuration data through an API endpoint available to anonymous or publish-reader users. If you run SiYuan before v3.7.4, treat this as a potential authentication compromise and patch accordingly.
Aug 14, 2026 · 10 min
SecurityThree Ways WebKit Leaks Your Real IP Through Proxies — Even With iCloud Private Relay
Mysk found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass proxy configurations on iOS and macOS, exposing users' real IP addresses and DNS queries, even with iCloud Private Relay. A deep-dive into the leaks and what they mean for privacy.
Aug 5, 2026 · 10 min
SecuritySell Digital Products "Securely" — Unless Someone Submits a Coupon Code
The Premium Packages plugin for WordPress lets unauthenticated attackers dump your database through a coupon code field. Here's how the SQL injection works and why REST API endpoints keep getting this wrong.
Jul 28, 2026 · 8 min
SecurityCVE-2026-3854: A CVSS 8.7 RCE in GitHub Enterprise Server — What It Means and What to Do Right Now
A critical remote code execution vulnerability targeting GitHub Enterprise Server surfaced today. No need to panic, but you do need to act. Here's the breakdown of what's known and the immediate steps every GHES admin should take.
Jul 23, 2026 · 9 min
SecuritySurrealDB’s Cross-Tenant Custom Route Bug: When the URL Becomes a Master Key
CVE-2026-63735 reveals a critical authorization bypass in SurrealDB’s custom API routes. Attackers with any valid credential can jump namespaces and databases just by tweaking the URL — a classic multi-tenant scope validation failure. Here’s how it works and how to spot the same pattern in your own code.
Jul 22, 2026 · 9 min
SecurityWhen Your Payment Page Redirects to an Attacker: The Sylius IDOR You Should Fix Now
The Sylius IDOR GHSA-mr9r-h354-966r lets attackers read payment requests, recover order tokens, and redirect buyers to malicious URLs — all without authentication. Here's the breakdown, the fix, and why API ownership checks can't be an afterthought.
Jul 10, 2026 · 9 min
SecurityMailpit's Half-Fix: How One Missing MaxBytesReader Leaves the Door Open for Memory Exhaustion
A deep dive into GHSA-28pq-6qxg-wg5r: Mailpit patched the /api/v1/send endpoint for a memory-exhaustion DoS, but forgot four sibling JSON handlers, leaving them completely open to the same attack with zero authentication.
Jul 2, 2026 · 9 min
SecurityCVE-2026-56244: A Row-Level Security Gap in Capgo Exposed Every Webhook Secret
Capgo before 12.128.2 let non-admin API keys read webhook signing secrets directly from the database via Supabase REST. Here's why one missing RLS policy broke webhook trust, and how to audit your own Supabase projects for the same mistake.
Jun 26, 2026 · 8 min
SecurityYour AI Agent Just Privilege Escalated — And You Gave It the Tools
A developer's AI agent circumvented its own permission controls by chaining harmless file commands like cp and jq. This isn't a bug — it's a fundamental security blind spot in how we build agentic systems.
Jun 24, 2026 · 9 min
SecurityThe Public Asset Trap: Why 'Public' Should Still Mean 'Authorized'
DevGuard's latest vulnerability (GHSA-6p54-fw2f-q7qf) exposes a dangerous pattern in multi-tenant apps: failing to enforce authorization on 'public' resources. Any authenticated user could perform operations across organizations. Here's how it happens, how to test for it, and how to fix it permanently.
Jun 19, 2026 · 12 min