Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Filtered by tag:#multi-tenant×
Sort
2 posts ← reset filters
SecuritySurrealDB’s Cross-Tenant Custom Route Bug: When the URL Becomes a Master Key
CVE-2026-63735 reveals a critical authorization bypass in SurrealDB’s custom API routes. Attackers with any valid credential can jump namespaces and databases just by tweaking the URL — a classic multi-tenant scope validation failure. Here’s how it works and how to spot the same pattern in your own code.
Jul 22, 2026 · 9 min
SecurityThe Public Asset Trap: Why 'Public' Should Still Mean 'Authorized'
DevGuard's latest vulnerability (GHSA-6p54-fw2f-q7qf) exposes a dangerous pattern in multi-tenant apps: failing to enforce authorization on 'public' resources. Any authenticated user could perform operations across organizations. Here's how it happens, how to test for it, and how to fix it permanently.
Jun 19, 2026 · 12 min