access-control
41 posts
YouTube exposed creators' private videos
YouTube creators' private videos were accessed and leaked. The private label failed as an access control. What that failure exposes, defined strictly.
Bypassing the paywall is not a billing bug
Cloudflare's x402 monetization gateway collapses payment and access enforcement onto one bypassable point, turning a billing layer into a single failure domain.
Security teams mislabeled the GPU bubble
The GPU bubble is not a hardware vulnerability. It is a demand spike against allocation systems that enforce no limit under scarcity.
Sandia's 8085 ran with the door unlocked
Sandia's SA3000 8085 CPU granted access on reachability, not identity. An unenforced boundary on a high-value resource is an open resource.
Looking was sufficient
Open webcams serve video to any connection because the deployment treats network reachability as authorization. A route is not permission.
Sony reaches into your account and deletes 551 movies
Sony deleting 551 movies exposes a control structure where purchase conferred revocable access, not ownership. The enforcement point was never the buyer's.
The zero-days are not the problem.
An anonymous GitHub account published undisclosed zero-days. The finding is not the exploits. It is an identity boundary that was never enforced at the action.
Saying you built it proves nothing
A contested 'vibe code' claim shows why self-reported origin accepted without verification is an unenforced control, not a trust boundary.
Cloudflare's self-managed OAuth secures nothing by default
Cloudflare's self-managed OAuth moves the enforcement point from provider to user. An unconfigured access control is an open path, not a safe default.
They walked out with the blueprints, not answers
Anthropic alleges Alibaba extracted Claude capabilities. The confirmed issue is structural: authenticated access governs entry, not what a party accumulates.
The guard checks the badge, never the room
Prompt injection is role confusion: systems that derive content authority from channel trust execute attacker input as instruction.
The channel trusted the sender
An unauthorized alert reached phones across Brazil. The confirmed finding is one control: sender authorization at the injection point did not hold.