API security
5 posts
The same-origin policy is not protecting your API
A permissive CORS header delegates the read decision to the requester, letting attacker script read authenticated responses through the victim's own browser.
Your API breach was working as designed
API authentication failing at the request level is a trust boundary failure. Inadequate identity validation makes lateral movement a design outcome.
340 million records, unverified seller
Technical analysis of plausible attack vectors behind the claimed OnlyFans 340M record leak, with detection signatures for each path.
Audi wired vehicles into a consumer auth flow
Audi Connected Vehicle security from an operator view: the boundary is no longer the key, it is the identity layer behind the myAudi app.
AI-Driven Attacks Expose a Fundamental Control Failure
Large-scale automated login attempts in Q2 2024 highlight a critical control failure: identity enforcement at request boundaries. The real risk is not AI, but trusting input based on origin rather than verification.