Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Sort
50 posts ← reset filters
SecurityA Valid OAuth State Does Not Prove You Own the GitHub Installation
A newly disclosed identrail flaw shows how a correctly scoped connection state can still be paired with an attacker-supplied GitHub App installation ID. The result is a cross-tenant path to another customer's private repository inventory.
Sep 13, 2026 · 10 min
SecuritySeaweedFS Bucket Isolation Breaks Through X-Amz-Copy-Source
A path traversal flaw in SeaweedFS lets a caller with access to one bucket copy objects from other buckets through the S3 gateway. Here is how the confused-deputy bypass works and what operators should do.
Aug 29, 2026 · 9 min
SecurityReachy Mini’s Unauthenticated Upload Endpoint Accepts More Than Sounds
A Reachy Mini daemon endpoint accepts unauthenticated uploads without extension, content, or size validation. Here’s why a seemingly minor media API flaw matters as part of a broader compromise chain.
Aug 26, 2026 · 10 min
SecurityThe Certificate Row Is Not the Certificate: A Revocation Bypass in Lemur
A newly disclosed Lemur flaw lets a low-privileged user create a duplicate certificate record and use it to revoke the real certificate at its issuing CA. The problem is a subtle but serious authorization mistake: trusting local row ownership instead of the CA-side certificate identity.
Aug 19, 2026 · 9 min
SecurityOne SSRF Control Is Not Enough: The Budibase Automation Bypass
A newly disclosed Budibase SSRF issue shows why outbound HTTP protection cannot live in one integration while automation steps call fetch directly. The real failure is architectural: security controls that are opt-in, inconsistent, and easy for new features to bypass.
Aug 15, 2026 · 9 min
SecurityA Leaked Cookie Signing Key Is an Auth Failure, Not a Configuration Bug
CVE-2026-72793 exposes sensitive SiYuan configuration data through an API endpoint available to anonymous or publish-reader users. If you run SiYuan before v3.7.4, treat this as a potential authentication compromise and patch accordingly.
Aug 14, 2026 · 10 min
SecurityThree Ways WebKit Leaks Your Real IP Through Proxies — Even With iCloud Private Relay
Mysk found three WebKit features — DNS prefetching, WebAuthn Related Origin Requests, and WebTransport — that bypass proxy configurations on iOS and macOS, exposing users' real IP addresses and DNS queries, even with iCloud Private Relay. A deep-dive into the leaks and what they mean for privacy.
Aug 5, 2026 · 10 min
SecuritySell Digital Products "Securely" — Unless Someone Submits a Coupon Code
The Premium Packages plugin for WordPress lets unauthenticated attackers dump your database through a coupon code field. Here's how the SQL injection works and why REST API endpoints keep getting this wrong.
Jul 28, 2026 · 8 min
SecurityCVE-2026-3854: A CVSS 8.7 RCE in GitHub Enterprise Server — What It Means and What to Do Right Now
A critical remote code execution vulnerability targeting GitHub Enterprise Server surfaced today. No need to panic, but you do need to act. Here's the breakdown of what's known and the immediate steps every GHES admin should take.
Jul 23, 2026 · 9 min
SecuritySurrealDB’s Cross-Tenant Custom Route Bug: When the URL Becomes a Master Key
CVE-2026-63735 reveals a critical authorization bypass in SurrealDB’s custom API routes. Attackers with any valid credential can jump namespaces and databases just by tweaking the URL — a classic multi-tenant scope validation failure. Here’s how it works and how to spot the same pattern in your own code.
Jul 22, 2026 · 9 min
SecurityWhen Your Payment Page Redirects to an Attacker: The Sylius IDOR You Should Fix Now
The Sylius IDOR GHSA-mr9r-h354-966r lets attackers read payment requests, recover order tokens, and redirect buyers to malicious URLs — all without authentication. Here's the breakdown, the fix, and why API ownership checks can't be an afterthought.
Jul 10, 2026 · 9 min
SecurityMailpit's Half-Fix: How One Missing MaxBytesReader Leaves the Door Open for Memory Exhaustion
A deep dive into GHSA-28pq-6qxg-wg5r: Mailpit patched the /api/v1/send endpoint for a memory-exhaustion DoS, but forgot four sibling JSON handlers, leaving them completely open to the same attack with zero authentication.
Jul 2, 2026 · 9 min