Practitioner notes on offensive security, compliance, and infrastructure from Kathmandu.
How an unauthenticated endpoint in a third-party feedback widget led to account takeover across dozens of companies — and a reusable methodology for finding it, called TBDSR.