appsec

Your Config Parser Is an Interpreter and the File Chooses What It Does

Configuration feels inert because it looks like data. Several formats can execute code and several loaders will by default, which makes parsing a security decision the moment the file comes from anywhere but your own repository.

Sep 18, 20265 min read

When the Cache Key Leaks One User's Page to Another

A personalised response cached under a key that does not include the thing that made it personal. One of the few bugs that discloses one customer's data to another with no attacker involved, and it arrives as a confused support ticket.

The Migration Is the Riskiest Part of the Pull Request

It runs in production with the highest privileges in your system, usually unattended, and gets reviewed as an implementation detail at the bottom of the diff. It can drop a constraint that was the only thing enforcing a security property.

Five Ways a Webhook Receiver Goes Wrong

It is a public, unauthenticated endpoint that performs privileged actions on a JSON body from the internet. Everyone knows this, and most implementations still get one of five things wrong in ways that pass every test.

Sep 18, 20265 min read

The Export Button Is the Shortest Path From Account to Your Data on a Laptop

Every other endpoint is paginated. Export deliberately is not. It ships as a feature request, reuses the read permission, and is almost never reviewed as a data egress channel.

Your Queue Consumer Is an Endpoint Nobody Reviewed

Your API validates every request and authenticates every caller. Behind it a worker reads messages and acts on them with none of those checks, because internal is trusted. That worker takes untrusted input and performs privileged actions.

Sep 18, 20265 min read

Your API Inventory Is Smaller Than Your API

The spec says one number, the gateway serves a larger one, and the difference is your unprotected surface: undecommissioned v1 routes, framework-generated handlers, and the debug endpoint added during an incident.

Best Practices

A Researcher Just Emailed You About a Vulnerability

What happens in the next twenty-four hours decides whether this becomes a fixed bug and a useful relationship, or a public disclosure with a thread about how badly you handled it. Most companies get it wrong in the first reply.

Best Practices

Writing a Security Finding an Engineer Will Actually Fix

Most findings are written for the person who found them: a vulnerability class, a CVSS score, an advisory link. Getting one fixed is a writing problem more than a detection problem.

Permission Models Are Not Designed, They Accumulate

An is_admin boolean, then a role column, then a special case for one customer. Three years later nobody can say what a given user can do without reading the code, and an auditor is asking.

Vulnerability Management

What to Do With a Critical Vulnerability That Has No Fix

Every remediation process assumes a patch exists. When the maintainer is gone and the package sits three levels deep in a tree you do not control, you need a different workflow: narrow the exposure, then decide, document, control and expire.

A Bare 400 Is Not a Security Posture

Empty error bodies get written by people worried about leaking internals, which is a real concern answered by the wrong control. Be precise about the caller's input, opaque about the system's state.