Engineering notes from the trenches.

phpMyFAQ Ships with an Empty API Token — And Yes, It's as Bad as It Sounds

A default empty API client token in phpMyFAQ lets any unauthenticated user create and modify FAQ entries, categories, and questions via the REST API. Here's what happened, why it matters, and how to fix it.