3 posts
A CORS misconfiguration usually starts with a red error in the browser console. Someone searches the message, finds a line that makes it go away, and ships it. The error is gone, but the API may now let any website read…
If you want to prepare for a penetration test, the most useful work happens before the testers touch your app. A penetration test is a security test where someone tries to find and prove weaknesses in your system, with…
Broken access control is when your app lets a signed-in user see or change something that belongs to someone else, or reach a feature meant for a different role. It is the most common serious flaw in web apps, and it is…