research

5 pieces of writing

Pre-operation access checks failed across 75 trust-boundary incidents analysed in arXiv:2607.01711

Authentication validation keeps failing because many API handlers prove access before the security-sensitive operation, then let state, identity or interpretation change underneath that decision.

15 July 2026

security13 min read

Authentication bypass in 2026: access validation keeps failing before critical operations

18 June 2026

security13 min read

CIFSwitch CVE-2026-46243 and PraisonAI show privilege escalation is an architectural antipattern

4 June 2026

security12 min read

Gogs, PraisonAI and KnowledgeDeliver show authentication bypass is a self-hosted platform design failure

Gogs, PraisonAI and KnowledgeDeliver show why authentication bypass in self-hosted platforms is often an architectural failure, not a missing if statement.

2 June 2026

security11 min read

Seven authentication bypasses that keep shipping in 2025 and 2026: the same architectural antipatterns, rewritten in new frameworks

7 April 2026