Search for a command to run...
Articles tagged with #security
When your policy engine, PDP, or permissions service times out, what does the API do? Returning 200 “just this once” so the page keeps working is fail-open. An attacker who can jam or delay that depen
Break-glass and "just this once" admin grants are where authorization quietly becomes permanent. If someone needs elevated access to fix production, grant it with: A hard expiry (minutes or hours, no
A common API-key mistake is issuing a token that means “this user” and then letting every endpoint decide what that implies. Prefer tokens scoped to the action you intend: read invoices for tenant X,
When you promote, demote, or revoke a user's roles, existing sessions often keep the previous permissions until they expire. That gap is a common auth bug: the admin panel shows the new role, while th
A standing admin or superuser role is a long-lived blast radius. The privilege sits there after the incident ends, ready to be copied, phished, or reused on a quiet afternoon. Prefer time-boxed elevat
A bare 403 tells the client “no.” It does not tell the engineer why. When an authorization check fails, return a stable reason code alongside the deny — missing role, wrong tenant, relationship not fo
