A login endpoint returning “unknown email” and “incorrect password” as separate messages, which is an account enumeration oracle with good intentions. Fixing the message and leaving the timing…
An endpoint returning 404 for a resource that exists but belongs to somebody else, and 403 for one that exists and is forbidden — which distinguishes the two.…
Copying two hundred lines out of a dependency, and the three things that make that legitimate rather than theft. The licence file, the upstream commit hash and the…
Adding a person meant editing a file on eleven hosts, and removing one meant remembering to. The eight-hour validity is what makes revocation mostly unnecessary — a departed…
A limit keyed on the client address, and four integrators behind one corporate gateway sharing a quota. Keying on the credential is the only fair unit when consumers…