Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Filtered by tag:#API security×
Sort
4 posts ← reset filters
SecurityA Valid OAuth State Does Not Prove You Own the GitHub Installation
A newly disclosed identrail flaw shows how a correctly scoped connection state can still be paired with an attacker-supplied GitHub App installation ID. The result is a cross-tenant path to another customer's private repository inventory.
Sep 13, 2026 · 10 min
SecurityReachy Mini’s Unauthenticated Upload Endpoint Accepts More Than Sounds
A Reachy Mini daemon endpoint accepts unauthenticated uploads without extension, content, or size validation. Here’s why a seemingly minor media API flaw matters as part of a broader compromise chain.
Aug 26, 2026 · 10 min
SecurityWhen Your Payment Page Redirects to an Attacker: The Sylius IDOR You Should Fix Now
The Sylius IDOR GHSA-mr9r-h354-966r lets attackers read payment requests, recover order tokens, and redirect buyers to malicious URLs — all without authentication. Here's the breakdown, the fix, and why API ownership checks can't be an afterthought.
Jul 10, 2026 · 9 min
SecurityThe Public Asset Trap: Why 'Public' Should Still Mean 'Authorized'
DevGuard's latest vulnerability (GHSA-6p54-fw2f-q7qf) exposes a dangerous pattern in multi-tenant apps: failing to enforce authorization on 'public' resources. Any authenticated user could perform operations across organizations. Here's how it happens, how to test for it, and how to fix it permanently.
Jun 19, 2026 · 12 min