Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Filtered by tag:#SSRF×
Sort
2 posts ← reset filters
SecurityOne SSRF Control Is Not Enough: The Budibase Automation Bypass
A newly disclosed Budibase SSRF issue shows why outbound HTTP protection cannot live in one integration while automation steps call fetch directly. The real failure is architectural: security controls that are opt-in, inconsistent, and easy for new features to bypass.
Aug 15, 2026 · 9 min
SecurityShopware’s SSRF Bypass Is a Textbook Example of the Adjacent Endpoint Problem
A patched SSRF in Shopware’s uploadFromURL left a nearly identical endpoint exposed – here’s how the bypass works, why even HEAD requests matter, and how to keep your own APIs from suffering the same fate.
Jun 5, 2026 · 12 min