Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Filtered by tag:#authorization×
Sort
5 posts ← reset filters
SecurityThe Certificate Row Is Not the Certificate: A Revocation Bypass in Lemur
A newly disclosed Lemur flaw lets a low-privileged user create a duplicate certificate record and use it to revoke the real certificate at its issuing CA. The problem is a subtle but serious authorization mistake: trusting local row ownership instead of the CA-side certificate identity.
Aug 19, 2026 · 9 min
IndustryMCP Connected Everything to Everything—Except to a Brake Pedal
The Model Context Protocol standardized how AI agents talk to tools, but left a massive governance gap. One developer's frantic build reveals a future we all need to see.
Jul 30, 2026 · 8 min
SecurityThe Public Asset Trap: Why 'Public' Should Still Mean 'Authorized'
DevGuard's latest vulnerability (GHSA-6p54-fw2f-q7qf) exposes a dangerous pattern in multi-tenant apps: failing to enforce authorization on 'public' resources. Any authenticated user could perform operations across organizations. Here's how it happens, how to test for it, and how to fix it permanently.
Jun 19, 2026 · 12 min
SecurityThe API trusted the token. That's the whole story.
A comment in nebula-mesh's code confesses the design flaw: API trusts the bearer token for authorization. Here's why that breaks multi-tenant isolation, how to spot the pattern, and how to fix it before it becomes an incident.
Jun 9, 2026 · 10 min
SecurityArcane's Global Variables Endpoint Has Zero Auth — And It Writes to Every Project
CVE GHSA-jpjh-jm2p-39hh: Arcane's PUT endpoint for global environment variables has no authorization check, letting any authenticated user overwrite .env.global and inject variables into every project's compose file.
May 23, 2026 · 10 min