MMaheshinblog.filtercoffeeway.com·8h ago · 7 min readI attacked my own finance bot. The fix wasn't a better prompt.TL;DR An AI with no tools can still be tricked. One line of hidden text made my bot think a bill was "paid in full" when it was still due. It worked 3 times out of 3. A better prompt doesn't fix thi00
ABAuth By Exampleinauthbyexample.hashnode.dev·5h ago · 1 min readA saved view can keep listing rows the user can no longer openSaved views often store a filter (status = open, owner = me) or a snapshot of matching IDs. The list endpoint re-runs that filter for the current user, but some implementations only re-apply the saved00
ABAuth By Exampleinauthbyexample.hashnode.dev·4h ago · 1 min readA scheduled report can email rows the recipient cannot open in the appScheduled reports are often built once by a worker that has broad read access, then the same PDF or CSV goes to everyone on the subscriber list. The worker never asks what each recipient is allowed to00
EBElijah Browninelijahbrown.hashnode.dev·1m ago · 10 min readThe SMS bill nobody planned for: when a signup form sends a code to any number typed inIf your signup form sends a one-time code by SMS, you have built a button that spends money on behalf of whoever presses it. Most of the time the person pressing it wants to sign up. Sometimes they wa00
DKDimitry Katzinbasiliskin.hashnode.dev·4h ago · 18 min readYour AI Coding Agent Is Not Sandboxed Just Because It Runs in DockerThe architecture in this article is an invented example used to explain security principles. It does not describe a deployed system or a configuration that has been independently tested. A coding agen00
Ccircuitrocksincircuitrocks.hashnode.dev·2h ago · 2 min readRP2350 Laser Attack: Ledger Donjon Re-Enables DebugHere is your shopping list for reproducing this RP2350 attack: one RP2350-A4 chip pulled off its board and de-encapsulated, a focused infrared laser, specialised microscopy gear, and roughly $250,000 00
LILock It: Calculator Vaultinlockitvault.hashnode.dev·5h ago · 2 min readDesigning a vault whose front door is a working calculatorPhones get passed around all day: to show a photo, share directions, or let someone make a quick call. That's normal. But most of us also keep a few things on our phones that are nobody else's busines00
PPDF4meinpdf4me1.hashnode.dev·6h ago · 5 min readHow to Remove a Password From a Protected Excel File via APISomebody in finance sends you a nightly export. It's encrypted, because of course it is, their IT policy requires it, and the password lives in a shared vault your automation already has access to. Yo00
RRainyTechinrainytech.hashnode.dev·6h ago · 6 min readFastAPI JWT Authentication in 2026: A Complete Login API in One File (Argon2 + PyJWT, Tested)Most FastAPI auth tutorials stop at "it returns a token". This one goes further: one file, 118 lines, five endpoints, and every response below comes from actually running it, including the failure cas00
UEUsama Ejazinusamaejaz.hashnode.dev·6h ago · 9 min readCAA Records and Your Blog Host: Which Record Applies, and Which CA to AllowIf your blog host says the domain is connected but the HTTPS certificate never shows up, and your DNS zone has a CAA record, that record probably doesn't name the certificate authority your host uses.00
