Articles
Security notes
Common vulnerabilities, each with an interactive demo, the vulnerable code and the fix.
- 01 IDOR: reading other users’ invoices by changing an ID An API that authenticates the request but never checks who owns the object it returns. Read →
- 02 JWT "alg": "none": forging an admin token A verifier that trusts the algorithm named in the token header can be told to skip the signature check. Read →
- 03 MITM: an API that trusts the client’s price A checkout endpoint that charges whatever price the client sends. Read →
- 04 Indirect prompt injection: a PDF that drives your agent Instructions hidden in content an LLM agent reads can trigger its tools. Read →
- 05 Timing attacks: recovering a secret from response times An early-exit comparison leaks how many leading characters of a guess are correct. Read →
- 06 SQL injection: authentication bypass with a single quote User input concatenated into a query becomes part of the SQL. Read →