web application security
3 posts
Article
On 18 June, no hack - broken access control
Red-team breakdown of the OpenAI agent that reached Australian government Medicare files: broken access control, not a hack, mapped to MITRE ATT&CK.
Article
A bypassed control is worse than no control
CSSQuake is a demonstrable bypass of web application protections through trust manipulation and control boundary erosion. A breakdown of what failed and why.
Article
Back Button Hijacking Is Not a Bug-It's a Trust Boundary Failure
Back button hijacking isn't a bug-it's a trust boundary failure. When client-side state persists after logout, authenticated content remains accessible without server-side validation. This is not browser behavior; it's a design flaw in access control enforcement.