RAMYA LAKHANI

Writeups

One thing that broke, taken apart: the assumption behind it, the mechanism, and the change that closed it.

All writeups

WRITEUP

Six places a secret survives .gitignore

Ignoring .env stops one file being committed. It does not stop the value reaching the client bundle, the test fixtures, or the history you already pushed.WRITEUP

IDOR in a Next.js route handler, and why middleware does not stop it

Route handlers are just functions. Middleware authenticates the request, then the handler fetches by id and never checks who is asking.