API discovery is the practice of finding every endpoint that answers requests in your estate, whether or not anyone documented it…

Sometimes while testing an application, you find interesting things simply because you stop and ask:

An API key identifies the project or application behind a request. An OAuth access token identifies a principal and carries a scope and an…

Last Monday the SOC had a loud Attack Analytics incident and still could not say which signature would block the next request.

Tibo, the Codex engineering manager, has announced on social media a notable change. Starting tomorrow, the ChatGPT Pro 20x subscription reopens to new users. Existing subscribers can renew as usu…

I’ve seen this comment in production code more than once:

A valid OTP arrived.

Four questions for designing auth on any RAG API, including the two attackers most designs forget. Grounded RAG in Production, Part 1.

What happens if you give a friend your OpenAI API key and they paste a customer’s email address into a prompt? Or run up a $200 bill…

How a hidden GraphQL query, a client-side authorization check, and an unescaped SQL LIKE wildcard turned an ordinary employee account into…

Verifying the signature isn’t enough. Three forms of one JWT and SAML validation flaw, real CVE records, and a checklist tied to NIST IR…

Autor: Walter Gómez. Fecha de corte de la información: 1 de octubre de 2026. Palabras clave: credenciales comprometidas, infostealers…

Rate limiting is a security and performance technique used to control the number of requests a user, device, or application can send to a…

Team used hash_equals. Pen-test found 15ms timing leak anyway. Where the signal actually comes from, verified in PHP 8.3.

Why borrowed OAuth tokens break agent authorization, and the four controls that replace them.

A buyer’s guide to testing workflow budgets, shared capacity, and the evidence needed for release approval.

I didn’t find a vulnerability in the API. I found the API’s own instruction manual, sitting at a URL nobody had bothered to hide, and it…

APIs are used by websites, mobile apps, online stores, and other applications to exchange data. But when an API accepts user input and…

One changed ID can leak a million records. Here’s how API attacks really work, and how to stop them.

The problem nobody planned for