Application Security Questions, Answered from Published Work — Ramya Lakhani

Access control

How do you test for object level authorisation flaws like IDOR?List every endpoint that accepts an identifier — in the path, the query string or the body.1 min2 sources

Secrets and configuration

Where do hardcoded secrets usually hide in a repository?In history, from before .gitignore existed — deleting the file later does not remove it.1 min1 source

AI-generated code

Why do AI code assistants introduce authorisation bugs?Most vulnerability classes have a local fix a model can learn. Authorisation does not.1 min2 sources

Working with me

What does a security review of a small codebase actually cover?Authentication and session handling, access control, and secrets in code and configuration.1 min3 sources