Anonymized · recent review
During a recent review for a large organization, we found four small mistakes. An authorization check that could be bypassed. A secret buried in a JavaScript bundle. A broken OIDC login flow. And the application’s entire front end shipped to the browser before login — handing anyone the complete list of API endpoints.
A vulnerability scanner would flag some of these. Low severity, each.
Together, they left the entire database open to the internet. Read and write. Trivial to cover your tracks. An AI agent pointed at the public portal would have chained them in minutes — chaining is what agents do. It’s the worst vulnerability we’ve seen, and it was made of ordinary mistakes.
There is no way to know whether anyone got there first.
1. An authorization check that could be bypassed.
The check existed. It ran on most requests. There was a path around it that nobody had noticed, because nobody had been looking for a path around it.
Check
For every endpoint that reads or writes data belonging to a user, find the line that confirms the caller owns that data. Not the line that confirms they’re logged in — the line that confirms it’s theirs. If you can’t find it in under a minute, assume it isn’t there.
2. A secret in the JavaScript bundle.
A credential meant for the server had been built into the front end, where anyone can read it.
Check
Download your production bundle and search it for anything resembling a key, a token, or a connection string. Then search your repository for the environment variables your front-end build can see.
3. A broken OIDC flow.
The login handshake accepted something it should have rejected. On its own, an oddity.
Check
Does the callback validate state? Does it verify the token’s audience and issuer? Does the post-login redirect accept an arbitrary URL?
4. The whole application delivered before login.
The full front-end bundle was served to anyone who visited, authenticated or not. It contained the complete list of API endpoints — a map.
Check
Open your app in a private window. Don’t log in. Open the network tab. Whatever loads is what an attacker gets for free.
How they combined.
The map from (4) said where to go. The key from (2) got in the door. The bypass from (1) opened every record. The flow from (3) made it look like a normal user. Read and write to the entire database, from the public internet, with no credentials of your own, and enough access to cover the trail.
A scanner would list two or three of these at low or medium severity. None of them is the vulnerability. Any process that scores findings one at a time will miss the only finding that matters.
The fix took two days. Not six months — which was the first proposal — two days, once the team saw the chain instead of the list.