MNMilan Nikicinsecuritydepth.hashnode.dev·Jun 30 · 27 min readBroken Access Control in Java and Spring: A Security Architect's PerspectivePart 1 covered horizontal privilege escalation and IDOR, walking through ownership validation, Spring Security method-level authorization, and the bypass techniques that keep showing up in assessments00
MNMilan Nikicinsecuritydepth.hashnode.dev·Jun 22 · 27 min readBroken Access Control in Java and Spring: Secure Implementation Patterns (Part 2)Part 1 covered horizontal privilege escalation, where users access resources that belong to other users at the same privilege level. We walked through IDOR vulnerabilities in path parameters, query pa00
MNMilan Nikicinsecuritydepth.hashnode.dev·Jun 16 · 21 min readBroken Access Control in Java and Spring: Secure Implementation Patterns (Part 1)Broken Access Control sits at the top of the OWASP Top 10 2025, and that ranking tells an important story. Authentication answers a simple question: who is this person? Authorization answers a harder 00
MNMilan Nikicinsecuritydepth.hashnode.dev·May 11 · 22 min readOS Command Injection: Security Architect's Perspective (Part 2)In Part 1 of this series, we cover OS command injection vulnerabilities from a developer's perspective. We looked at secure coding approaches with ProcessBuilder, whitelist-based validation strategies00
MNMilan Nikicinsecuritydepth.hashnode.dev·May 5 · 19 min readOS Command Injection in Java: Secure Coding Patterns (Part 1)There are times when using the Java APIs is simply not sufficient. Video processing using FFmpeg, obtaining EXIF information, integrating with legacy tools – all of these are valid reasons for accessi00