Writeups

Notes from building and breaking security-focused software.

All writeups, newest first

  1. Why authorization bugs outlive authentication bugsAuthentication is a single gate you can test once. Authorization is a decision repeated at every endpoint, and that asymmetry is why broken access control keeps topping the charts.Application Security3 min read