access-control
35 posts
The zero-days are not the problem.
An anonymous GitHub account published undisclosed zero-days. The finding is not the exploits. It is an identity boundary that was never enforced at the action.
Saying you built it proves nothing
A contested 'vibe code' claim shows why self-reported origin accepted without verification is an unenforced control, not a trust boundary.
Cloudflare's self-managed OAuth secures nothing by default
Cloudflare's self-managed OAuth moves the enforcement point from provider to user. An unconfigured access control is an open path, not a safe default.
They walked out with the blueprints, not answers
Anthropic alleges Alibaba extracted Claude capabilities. The confirmed issue is structural: authenticated access governs entry, not what a party accumulates.
The guard checks the badge, never the room
Prompt injection is role confusion: systems that derive content authority from channel trust execute attacker input as instruction.
The channel trusted the sender
An unauthorized alert reached phones across Brazil. The confirmed finding is one control: sender authorization at the injection point did not hold.
Completing the task was the breach
An identity completed tasks it was never provisioned for. The boundary was described, not enforced. This is a control gap, not a competence problem.
Google gates Workspace by browser, not credential
Google Workspace's move to gate Firefox keys access on a client signature, not identity. A control on the wrong boundary does not stop attackers.
demand is not a control
Stop Killing Games gathered 13 million signatures and produced no EU law. The proposed approach lacked granular data access control and identity verification.
A valid JWT authenticates nothing
A JWT is a signed data structure, not authentication. The security lives in the verifier, not the token. Where validation is optional, the boundary is gone.
The door was unlocked, not picked
Federal concern over fable 5 was a trust boundary failure, not a jailbreak. Fix this code targets content, not access enforcement.
One login screen now guards your entire machine
Windows 11's forced Microsoft account moves the identity boundary to one access point. Compromise the account and you assume the control, not bypass it.