---
title: "Comment by Damiano Bianda on \"From Developer to Attacker: Automatic Authentication Bypasses with python\" | Hashnode"
description: "The most valuable part of your framing is the developer origin - because the bypasses that automation actually finds are almost always the ones the framework ma"
url: "https://hashnode.com/posts/from-developer-to-attacker-automatic-authentication-bypasses-with-python/6af0feb9c312080bf865ab39/comment/6af1999dbcff827a3c7abae6"
---

[Discussion](https://hashnode.com/posts/from-developer-to-attacker-automatic-authentication-bypasses-with-python/6af0feb9c312080bf865ab39)

Comment [From Developer to Attacker: Automatic Authentication Bypasses with python](https://hashnode.com/posts/from-developer-to-attacker-automatic-authentication-bypasses-with-python/6af0feb9c312080bf865ab39)

[Damiano Bianda](https://hashnode.com/@damianobianda)

[2d ago](https://hashnode.com/posts/from-developer-to-attacker-automatic-authentication-bypasses-with-python/6af0feb9c312080bf865ab39/comment/6af1999dbcff827a3c7abae6)

The most valuable part of your framing is the developer origin - because the bypasses that automation actually finds are almost always the ones the framework made easy to leave in. Forced browsing to /admin or an unprotected API route, JWTs accepted with alg=none or a weak symmetric secret, OTP endpoints without rate limiting, password reset tokens that are sequential or never expire: none of these need creativity, they need a checklist and a loop, which is exactly why the attacker's Python script exists. The inversion I'd offer to developers reading this: the same script is a regression test. Every bypass class you automate from the red side can run in CI from the blue side - spin up the app, run the forced-browsing wordlist, try alg=none against your own JWT endpoint, hammer the OTP route and count the responses. If your pipeline tolerates it, so will the internet. And the second-order point: authentication bypasses are loud in logs only if someone logs the failures - 401s on /admin, JWT signature rejections, OTP attempt counts. Most breaches of this kind were visible for weeks; nobody was reading the counter.