Writeups
Write-ups
Security write-ups, guides and notes hosted on this site. Findings appear here only after they are fixed and cleared for disclosure. For pieces published on Medium, see Articles.
2026
- How a Missing Owner Check Exposed Every Order
A shopping API let any signed-in user read any order just by changing a number in the URL. The server checked that you were logged in, but never that the order…
No match. Try a shorter keyword or clear the filter.