Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Filtered by tag:#IDOR×
Sort
2 posts ← reset filters
SecurityA Valid OAuth State Does Not Prove You Own the GitHub Installation
A newly disclosed identrail flaw shows how a correctly scoped connection state can still be paired with an attacker-supplied GitHub App installation ID. The result is a cross-tenant path to another customer's private repository inventory.
Sep 13, 2026 · 10 min
SecurityWhen Your Payment Page Redirects to an Attacker: The Sylius IDOR You Should Fix Now
The Sylius IDOR GHSA-mr9r-h354-966r lets attackers read payment requests, recover order tokens, and redirect buyers to malicious URLs — all without authentication. Here's the breakdown, the fix, and why API ownership checks can't be an afterthought.
Jul 10, 2026 · 9 min