A Valentine’s gift shop with a hidden item called “Valenflag” sitting somewhere in the catalog. Subtle as a brick, but honestly that’s…

Building a REST API is only half the battle; securing it is where the real engineering begins. In the world of modern web development, JSON…

This is the 2nd part in a two-part series on JWT security. If you haven’t read Part 1 of this series, I recommend checking that out first…

It’s just base64 and a bit of math.

JSON JSON EVERYWHERRRREE !!!

WSO2 patched it in April. Attackers exploited it in September.

I studied JWT attacks properly through the PortSwigger Web Security Academy. Then I moved on to other things, and when I came back to JWTs…

This was my first real bug bounty finding, and somehow, it turned into a Critical vulnerability with a $1,500 bounty.

If you work with APIs, you’ve probably heard these terms many times:

When I was testing a KYC verification flow during a bug bounty program, I came across an endpoint that accepted a JWT through a URL…