Notes & writeups.

16 JUN 2026

Teste

14 MAR 2026

alg=none: forging admin tokens against an unguarded verifier

A single missing allow-list turned a read-only API into full admin access. Here's the full chain — from a grep hit to 14 admin records returned.