The newest Authorization / Broken Access Control resources are on the Authorization / Broken Access Control page. For a reading order instead of a date order, see the Authorization / Broken Access Control learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-06-19 2026 | Data access governance: Who's got the keys to your data kingdom? beginner 4 min read | Capabilities for data access governance leverage Wiz DSPM and CIEM to discover sensitive data, analyze effective permissions of human and non-human identities, and govern access to critical data across multi-cloud environments, including Snowflake and OpenAI, while identifying and remediating risky identities with access to sensitive information. → wiz.io |
| 2026-06-19 2026 | Preventing broken access control in express Node.js applications beginner 11 min read API Sec | Library detailing broken access control vulnerabilities in Express Node.js applications, covering scenarios like unprotected admin panels, predictable user IDs leading to IDOR, and insecure direct object references. It illustrates how to prevent issues such as vertical privilege escalation and horizontal data exposure, emphasizing the risks of clear text logging and insufficient CSRF protection within Express middleware. → snyk.io |
| 2026-06-19 2026 | I almost ordered a product for free. (Business Logic Vulnerability) beginner | Security engineer Sumeet Mahadik discovered a business logic vulnerability that nearly allowed him to order a product for free. While the exact method isn't detailed, the vulnerability presented an opportunity for significant savings. The content is the beginning of a blog post where Mahadik intends to explain his findings. → infosecwriteups.com |
| 2026-06-19 2026 | “Bug Bounty Bootcamp #47: Account Takeover 101 — How to Steal Everyone’s Account (Legally)” beginner IDOR | This article from Bug Bounty Bootcamp #47, "Account Takeover 101," explains how to legally perform account takeovers. It highlights common vulnerabilities like Insecure Direct Object References (IDOR), leaked invite links, and mass-assignable "role" fields as key entry points. The content suggests that sophisticated hacking skills are not necessary to exploit these weaknesses. → infosecwriteups.com |
| 2026-06-18 2026 | New Developments in LLM Hijacking Activity intermediate 3 min read AI | Writeup on the JINX-2401 LLM hijacking campaign targeting AWS, detailing IAM privilege escalation tactics and attempts to invoke Bedrock models. This campaign leverages compromised IAM user access keys and employs specific naming conventions for newly created IAM users and policies like "New_Policy". The report also highlights detection strategies for CloudTrail logs and Wiz Defend rules to identify suspicious activity related to LLM abuse and IAM credential misuse. → wiz.io |
| 2026-06-17 2026 | Wiz Research Identifies Exploitation in the Wild of Aviatrix Controller RCE (CVE-2024-50603) news 4 min read RCE | Analysis of CVE-2024-50603, an unauthenticated RCE vulnerability in Aviatrix Controller, details its exploitation in the wild for cryptojacking and backdoor deployment, including Sliver and Mirai. This command injection flaw, stemming from improper input neutralization, allows arbitrary command execution and can lead to privilege escalation in AWS control planes. Patched versions 7.1.4191 and 7.2.4996 address this critical vulnerability. → wiz.io |
| 2026-06-16 2026 | How to use the new CloudTrail network activity events for AWS VPC Endpoints intermediate 6 min read | Reference on AWS VPC Endpoint CloudTrail network activity events, detailing how to enable and utilize these new opt-in events for CloudTrail to gain visibility into API activity traversing VPC Endpoints. It covers using these logs for safely developing VPC Endpoint Policies, detecting data exfiltration, and understanding network connections between VPC services and AWS resources, with specific mention of supported services like S3 and KMS, and considerations for cost and coverage compared to Data Events. → wiz.io |
| 2026-06-16 2026 | CIEM and Secure Cloud Access: Best Practices from Wiz and CyberArk intermediate 5 min read | Library integrating Wiz and CyberArk, this resource details best practices for Cloud Infrastructure Entitlements Management (CIEM) and Secure Cloud Access. It emphasizes gaining full visibility into cloud identities and permissions, enforcing least privilege, prioritizing critical attack paths, and implementing Zero Standing Privileges (ZSP). The entry also covers applying privilege controls post-authentication, maintaining continuous identity governance, and enabling on-demand access for unplanned events, aiming to balance security with productivity. → wiz.io |
| 2026-06-16 2026 | Wiz Data Foundations: Where’s My Sensitive Data—And Who Can Access It? intermediate 3 min read | Library for cloud data security that offers visibility into sensitive data locations and access controls. It features an agentless scan to detect and classify sensitive data, a Data Stores Treemap for visualizing data distribution by resource type and sensitivity, and multiple workflows to explore access entitlements by data store, identity, or through the Security Graph. The library helps identify who can access sensitive data, how access was granted, and any associated risks, supporting workflows from broad trends to deep, targeted investigations. → wiz.io |
| 2026-06-16 2026 | Federal Data, Meet your New Bodyguard: DSPM joins Wiz for Government news 3 min read | Library for automated sensitive data discovery and classification within FedRAMP environments. This DSPM solution provides visualization of data residency, access controls, and attack paths, aiding in compliance with regulations like GDPR, CCPA, HIPAA, FISMA, OMB M-17-12, CMMC, and Zero Trust principles. It supports agentless scanning, custom data classification rules, and AI readiness by identifying sensitive training data and potential leaks, ultimately reducing the data attack surface and accelerating federal data security use cases. → wiz.io |
| 2026-06-15 2026 | What Changed in OWASP Top 10 2025? Full Breakdown & Recommendations beginner 13 min read | Analysis of the OWASP Top 10 2025 identifies two new categories: Software Supply Chain Failures (A03) and Mishandling of Exceptional Conditions (A10). Security Misconfiguration has jumped to #2, highlighting risks from continuous deployment without continuous scanning. Broken Access Control (A01) now explicitly includes BOLA and BFLA, crucial for API security. While OWASP's recommendations are sound, their application requires mature SDLC discipline and unified tooling. Software Supply Chain Failures (A03) shows a high incidence rate but low CVE coverage, indicating current attacks with limited scanner detection. Addressing these shifts by category can improve an organization's security posture. → blog.qualys.com |
| 2026-06-15 2026 | Wiz Research Uncovers Critical Vulnerability in AI Vibe Coding platform Base44 Allowing Unauthorized Access to Private Applications news 8 min read AI | Writeup on an authentication bypass vulnerability in the Base44 vibe coding platform, discovered by Wiz Research. Attackers could exploit undocumented registration and email verification endpoints by providing a non-secret `app_id` to create verified accounts for private applications, bypassing SSO and gaining unauthorized access to sensitive enterprise data. The flaw was fixed within 24 hours by Base44 and Wix. → wiz.io |
| 2026-06-15 2026 | Securing the Digital Future: AppSec Best Practices in Digital Banking beginner 3 min read API Sec | Talk slides from the Digital Banking Asia Summit 2024 outlining application security best practices for financial services. The presentation highlights key challenges including regulatory compliance, third-party integration, sophisticated attackers, complex architectures, legacy systems, resource limitations, insider threats, and balancing release velocity with security. It also addresses developer-security team disconnects due to lack of shared context, leadership priorities for CTOs and CISOs, and five pillars of success: developer adoption, security trust, effective fix delivery, a comprehensive platform, and a strong partner ecosystem. → snyk.io |
| 2026-06-14 2026 | Wiz Research Discovers One in Five Organizations Exposed to Systemic Risks in Vibe-Coded Applications - Here's How to Secure Them intermediate 8 min read API Sec | Library for securing applications built with "vibe coding" platforms like Lovable. It details common risks such as authentication logic living entirely in the browser, API keys and secrets exposed in client-side code, and database tables being wide-open. Solutions include enforcing server-side authentication, proxying API calls through a secure backend, and implementing proper Row-Level Security (RLS) for databases like Supabase. → wiz.io |
| 2026-06-14 2026 | Beyond CVEs: The Exploitation of Everyday Misconfigurations beginner 6 min read API Sec | Library detailing the exploitation of common cloud application misconfigurations, moving beyond traditional CVEs. It covers unrestricted access, default/weak credentials, excessive permissions, and exposed databases, providing real-world case studies of abuse. Examples include Selenium Grid RCE via arbitrary command execution, Spring Boot Actuator SSRF and sensitive data leakage through heap dumps, and PostgreSQL command execution using the `COPY FROM PROGRAM` feature with weak credentials. The library emphasizes proactive perimeter scanning and shifting security left within CI/CD pipelines to mitigate these risks. → wiz.io |
| 2026-06-14 2026 | CVE-2025-29927 Authorization Bypass in Next.js Middleware news 3 min read API Sec | Writeup of CVE-2025-29927, an authorization bypass vulnerability in Next.js middleware. This critical 9.1 severity flaw affects Next.js versions prior to 15.2.3, 14.2.25, and 13.5.9. Attackers can bypass middleware logic and access protected routes by manipulating the `x-middleware-subrequest` HTTP header. Developers are urged to upgrade Next.js versions or apply firewall rules to mitigate the risk. → snyk.io |
| 2026-06-13 2026 | Why Use App-Level Auth When Every Database Has Auth? (Splunk Enterprise CVE-2026-20253 Pre-Auth RCE) - watchTowr Labs news 15 min read RCE | Analysis of Splunk Enterprise CVE-2026-20253 details a pre-authentication RCE vulnerability affecting Splunk versions 10 and above. The flaw resides in the PostgreSQL Sidecar Service Endpoint, which, when installed and enabled by default (as on AWS deployments), allows unauthenticated attackers to trigger file operations via a proxied HTTP request to the main Splunk web application. This insecure endpoint, exposed on localhost but accessible through the main interface, can be leveraged for unauthorized actions. → labs.watchtowr.com |
| 2026-06-13 2026 | Header Manipulation: Bypasses, Probing, and the Security Audit Nobody Does intermediate API Sec | Request headers are not mere metadata but critical inputs that can be manipulated. Attackers exploit this to bypass access controls, probe for misconfigurations, spoof identities, and test security. This article delves into header manipulation techniques frequently encountered in penetration testing platforms, emphasizing their role in security assessments. → infosecwriteups.com |
| 2026-06-13 2026 | Full Fathom Five: The context of Anthropic’s Mythos-class public release beginner 6 min read AI | Reference detailing Anthropic's Claude Fable 5 release, clarifying it routes cybersecurity prompts to Opus 4.8 and is not for vulnerability discovery. It emphasizes that advanced LLMs aren't required for finding issues like IDORs and business logic flaws, highlighting that misconfigurations, exposed services, and broken identity edges constitute 80% of security problems, not just CVEs. The analysis critiques the fetishization of CVEs and zero-days, suggesting LLM tokens are better utilized for defensive scans, remediation, and exposure management. → aikido.dev |
| 2026-06-13 2026 | KCD New York 2026: Trust, Agents, and the Work Behind the Work news 8 min read AI API Sec | Talk slides from KCD New York 2026 cover securing cloud-native systems through zero trust principles with Istio Ambient Mesh, addressing discrepancies in Kubernetes CVE data from sources like MITRE and maintainer discussions, and enabling autonomous multi-cluster remediation via agentic AI and MCP servers. The importance of a "trust ladder" for remediation, starting with recommendations and progressing to opt-in auto-remediation, is highlighted, emphasizing robust identity and RBAC. The event also stressed that community, not just technology, forms the essential infrastructure for open-source projects, with initiatives like contributor onboarding crucial for sustainability. → blog.gitguardian.com |
| 2026-06-12 2026 | Bringing Oracle Cloud Identity to Wiz intermediate 3 min read | Library support for Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM) provides unified visibility across OCI, AWS, Azure, and GCP. It normalizes OCI's Identity Domains, Compartments, and natural-language policies into Wiz's security graph, allowing analysis of users, groups, service principals, access paths, and OCI API keys. This enables consistent cross-cloud controls and threat analysis by mapping OCI constructs like resource types and permissions to Wiz objects and access types. → wiz.io |
| 2026-06-11 2026 | Jupyter Enterprise Gateway - From Notebook to Kubernetes Cluster Admin - elttam intermediate 9 min read | Writeup detailing three vulnerabilities found in Jupyter Enterprise Gateway v3.2.3, allowing a notebook user to escalate privileges to full Kubernetes cluster administrator. These vulnerabilities, responsibly disclosed to the Jupyter security team and patched in v3.3.0, enable a user to bypass UID/GID restrictions by providing values with trailing spaces, leading to root execution within kernel pods. Combined with hostPath volume mounts, this allows access to sensitive cluster secrets, mounting host filesystems, and the creation of arbitrary privileged pods, potentially compromising the entire cluster. → elttam.com |
| 2026-06-10 2026 | Security Insights Where Work Happens: Notion Custom Agents + Wiz MCP news 3 min read AI | Library integration enabling Notion Custom Agents to securely access Wiz cloud security insights. This allows teams to answer security questions, generate automated reports, and investigate risks directly within Notion, bringing security context into collaborative workspaces where decisions are made. → wiz.io |
| 2026-06-10 2026 | Introducing Wiz Agents & Workflows: Security at the Speed of AI news 7 min read AI | Library introducing Wiz Agents and Workflows, a suite of AI-powered security tools designed to accelerate threat detection, investigation, and remediation. The Red Agent acts as an AI attacker to find logic-driven vulnerabilities, the Blue Agent investigates threats using cloud telemetry and runtime signals, and the Green Agent provides environment-specific remediation guidance. Workflows orchestrate these agents, enabling automated responses and scalable security operations grounded in the Wiz Security Graph's context. → wiz.io |
| 2026-06-10 2026 | ServiceNow's Virtual Agent Vulnerability Shows Why AI Security Needs Traditional AppSec Foundations beginner 6 min read AI AuthN | Library for securing AI agents, this resource details a critical vulnerability chain in ServiceNow's Virtual Agent that allowed platform takeover via broken API authentication, weak identity verification, and excessive agent privileges. It emphasizes that securing AI requires foundational application security practices like threat modeling, DAST for vulnerability detection, and AI red teaming to expose impact paths. The library advocates for a layered security approach, auditing agent permissions, enforcing strong API identity, and implementing continuous testing to address the evolving risks of agentic AI. → snyk.io |
| 2026-06-10 2026 | I Found the Entire Admin UI of a Live PlatformJust By Tweaking Traffic in Burp Suite intermediate Burp | Security researcher Hamza Hashim (refang) discovered the entire admin UI of the live internship program portal REDACTED.org by manipulating traffic in Burp Suite. While participating in the internship, Hashim found this vulnerability, which was part of a larger bug report submitted to the organization. The article details this specific finding from a real-world application. → infosecwriteups.com |
| 2026-06-10 2026 | Blinding the Watchmen: Abusing Cloud Logging Services for Defense Evasion and Visibility advanced 13 min read | Analysis of techniques for abusing cloud logging services, specifically AWS CloudTrail and Google Cloud Logging, to achieve defense evasion and maintain attacker visibility. The article details methods such as stopping logging, deleting log storage destinations like S3 buckets or Google Cloud log buckets, removing log routers (trails or sinks), impairing logging via attacker-controlled encryption keys, and log poisoning. Understanding these attack vectors helps organizations implement stronger security configurations to detect and prevent misuse of these critical visibility tools. → unit42.paloaltonetworks.com |
| 2026-06-08 2026 | Copy Fail: Universal Linux Local Privilege Escalation Vulnerability intermediate 4 min read | Writeup on CVE-2026-31431, a Linux kernel vulnerability dubbed "Copy Fail," allowing unprivileged local users to escalate to root. Discovered by Xint, it affects nearly all Linux kernels since 2017 due to a logic flaw in the AEAD crypto implementation, enabling attackers to overwrite file page cache and inject code into binaries like `/usr/bin/su`. Mitigation involves kernel updates or blocking AF_ALG socket creation via seccomp. Detection can involve correlating AF_ALG loading with other suspicious signals or monitoring for malformed `auth.log` entries from corrupted `su` binaries. → wiz.io |
| 2026-06-08 2026 | Dirty Frag: Linux Kernel Local Privilege Escalation via ESP and RxRPC intermediate 2 min read | Writeup of "Dirty Frag," a Linux kernel local privilege escalation vulnerability chain (CVE-2026-43284, CVE-2026-43500), exploiting flaws in the ESP and RxRPC subsystems. This deterministic vulnerability, a successor to Copy Fail (CVE-2026-31431), allows root privilege escalation by corrupting page-cache memory. Exploitation typically requires CAP_NET_ADMIN privileges, making it less likely in hardened containers but a significant risk for VMs. Affected code paths date back to 2017 for ESP and 2023 for RxRPC, impacting a wide range of kernel versions. → wiz.io |
| 2026-06-08 2026 | Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP intermediate 1 min read | Library for Linux kernel local privilege escalation, Fragnesia, targets the XFRM ESP-in-TCP subsystem. This vulnerability, a variant of DirtyFrag, allows unprivileged local attackers to modify read-only file contents in the kernel page cache and gain root privileges through deterministic page-cache corruption. The exploit manipulates AES-GCM keystream during decryption to overwrite critical binaries like `/usr/bin/su` with an ELF payload, achieving a root shell. Recommended mitigation involves applying vendor kernel patches or disabling vulnerable modules. → wiz.io |
| 2026-06-08 2026 | OSCP Windows Enumeration Checklist: My Complete Privilege Escalation Workflow for Every Box intermediate | This article details a comprehensive Windows enumeration workflow for the OSCP certification, focusing on privilege escalation. The author shares their exact process, highlighting key techniques like analyzing WinPEAS output, hunting for credentials, leveraging token abuse, and examining services. The goal is to provide a structured approach for tackling Windows-based machines encountered during the exam, ensuring thoroughness in identifying vulnerabilities and escalating privileges effectively. → infosecwriteups.com |
| 2026-06-08 2026 | Ransacking your password reset tokens intermediate 18 min read Bug Bounty | Library exposing sensitive data via attribute brute-force attacks in Ruby on Rails applications. The Ransack library's default configuration permits users to guess arbitrary attributes and values character by character, allowing extraction of sensitive information like password reset tokens. Similar vulnerabilities exist in technologies like Hasura and Sequelize. Ransack version 4.0.0 mitigates this by enforcing explicit allow lists for searchable attributes and associations. |
| 2026-06-08 2026 | Designing Identity for the Agentic Enterprise: The Okta AI Identity Summit news 7 min read AI | Survey of discussions from the Okta AI Identity Summit, focusing on the critical need for robust identity systems to govern agentic AI. Key themes include the evolution of identity beyond credentials to control actions, the necessity of discovery and real-time governance for shadow agents, and the imperative to future-proof identity architectures for non-human actors operating at machine speed, emphasizing that capability without accountability is not a viable strategy. → blog.gitguardian.com |
| 2026-06-08 2026 | Looting UniFi Controllers: Detecting and Weaponizing CVE-2026-22557 news 20 min read RCE | Tool for detecting and weaponizing CVE-2026-22557, an unauthenticated path traversal vulnerability in UniFi Network Application's guest captive portal. This critical flaw, with a CVSS score of 10.0, allows attackers to read arbitrary files, potentially exfiltrating administrative credentials from controller backups. The analysis details practical attack paths, exploitation preconditions, and offers a safe detection tool available on GitHub. Affected versions require patching to 10.1.89, 10.2.97, or 9.0.118 or later. → bishopfox.com |
| 2026-06-08 2026 | Otto Support - Testing MCP Servers intermediate 3 min read | Tool for testing MCP servers; utilizes nmap for discovery, a Nuclei template to identify MCP endpoints, and MCP Inspector to enumerate services and exploit an authorization gap. This bypass allows an unprivileged user to delete other users' tickets by directly calling the `delete_ticket` JSON-RPC method, demonstrating that MCP servers share familiar security fundamentals with traditional web services. → bishopfox.com |
| 2026-06-08 2026 | Popping Root on UniFi OS Server: Unauthenticated RCE Chain Detection & Analysis news 18 min read RCE | Library providing analysis of the UniFi OS Server RCE chain (CVE-2026-34908, CVE-2026-34909, CVE-2026-34910), which allows unauthenticated attackers to gain root privileges. It details the bypass of the authentication gateway, path traversal, and command injection vulnerabilities, and outlines remediation steps including patching to version 5.0.8 or later, rotating secrets, and rebuilding compromised systems. A detection tool is also available to identify vulnerable instances. → bishopfox.com |
| 2026-06-08 2026 | How to scan for vulnerabilities with GitHub Security Lab’s open source AI-powered framework intermediate 22 min read AI Secrets | Library that leverages the GitHub Security Lab Taskflow Agent for AI-powered vulnerability scanning. This framework, designed to find high-impact web security vulnerabilities like authorization bypasses and information disclosure, operates through taskflows written in YAML that guide LLM analysis. It breaks down auditing into stages, starting with threat modeling to define component boundaries and then suggesting potential vulnerabilities, followed by a rigorous triage step to minimize false positives and hallucinations. This approach has successfully identified over 80 vulnerabilities, with many disclosed, and is open-source for community contribution. A GitHub Copilot license is required for execution. → github.blog |
| 2026-06-08 2026 | Bypassing Administrator Protection by Abusing UI Access intermediate 18 min read Bug Bounty | Writeup detailing bypasses of Windows Administrator Protection by abusing UI Access. This vulnerability stems from the UAC UIPI bypass mechanism, allowing processes with the UI Access flag to interact with higher integrity windows. The research uncovered multiple bypasses by exploiting this feature, particularly when a UI Access process is created with a High integrity level. This enables limited users to potentially compromise administrator processes by sending messages or, if at the same integrity level, using window hooks for DLL injection. → projectzero.google |
| 2026-06-08 2026 | A Deep Dive into the GetProcessHandleFromHwnd API advanced 14 min read Bug Bounty | Reference detailing the `GetProcessHandleFromHwnd` API's evolution, tracing its implementation from a user-mode function in `oleacc.dll` utilizing Windows hooks in Vista to a kernel-mode function `NtUserGetProcessHandle` in `win32kfull.sys` in Windows 10. The analysis highlights discrepancies between documentation and actual behavior, including UAC bypass possibilities and integrity level checks enforced by the kernel function. → projectzero.google |
| 2026-06-08 2026 | The sorry state of skill distribution news 9 min read AI | Analysis of skill scanners reveals critical vulnerabilities in agentic system security. Testing bypassed defenses in ClawHub, Cisco's agent skill scanner, and skills.sh integrations, employing techniques like file truncation and .pyc bytecode poisoning. These bypasses highlight static analysis limitations against adversaries who can repeatedly tweak attacks, demonstrating that current scanners struggle to detect malicious skills embedded in archives or disguised as bytecode, echoing supply-chain attack patterns seen in incidents like the xz-utils backdoor. → blog.trailofbits.com |
| 2026-06-08 2026 | WebSocket Turbo Intruder: Unearthing the WebSocket Goldmine intermediate 7 min read API Sec | Library for fuzzing WebSocket messages with custom Python code, WebSocket Turbo Intruder extends the Burp Suite engine to exploit protocol-specific vulnerabilities. It includes a fast attack engine for high-volume testing against single targets, and features HTTP middleware for automating scans with tools like Burp Suite Pro. The library supports custom Python scripts with decorators like `@MatchRegex`, `@Pong`, and `@PingPong`, and offers a THREADED engine for race condition testing by opening multiple simultaneous connections. It also includes workarounds for Socket.IO testing, including handling the `EIO` parameter and detecting server-side prototype pollution. → portswigger.net |
| 2026-05-04 2026 | Critical MOVEit Automation auth bypass vulnerability fixed (CVE-2026-4670) news 2 min read | Writeup of CVE-2026-4670, a critical authentication bypass in Progress Software's MOVEit Automation, enabling unauthorized administrative control and data exposure. This vulnerability, along with a privilege escalation flaw (CVE-2026-5174), affects specific older versions and can be exploited via low-complexity attacks by unauthenticated or authenticated attackers, respectively. Upgrading to patched versions 2025.1.5, 2025.0.9, or 2024.1.8 is strongly advised to remediate these issues. → helpnetsecurity.com |
| 2026-05-02 2026 | CVE-2026-31431: Copy Fail vulnerability enables Linux root privilege escalation across cloud environments news 6 min read | Analysis of CVE-2026-31431, nicknamed "Copy Fail," details a high-severity Linux kernel vulnerability affecting Red Hat, Ubuntu, SUSE, and AWS Linux. This logic flaw in the AF_ALG module allows local unprivileged users to gain root privileges by corrupting the kernel page cache, impacting cloud workloads and Kubernetes clusters. The exploit, a small script leveraging the splice() system call and AF_ALG, enables container breakout and lateral movement, posing a significant risk to multi-tenant environments. Microsoft Defender provides detection insights, mitigation recommendations, and hunting guidance. → microsoft.com |
| 2026-04-22 2026 | Rights Management Approaches: ACL, RBAC, ABAC, ReBAC beginner 3 min read | Guide on access control models, including ACL, RBAC, ABAC, and ReBAC, for defining architectural security requirements. It covers practical guidance, trade-offs like UX friction and latency, and discusses Google's Zanzibar system as a canonical source for ReBAC. The guide offers phased roadmaps for implementation, focusing on inventory, RBAC baselines, context rules, and continuous verification, while highlighting common antipatterns and metrics for operational control. |
| 2026-04-22 2026 | OPA, Cedar, OpenFGA: Why Are Policy Languages Trending Right Now? news 9 min read | Library for understanding policy languages like OPA (Rego), Cedar, and OpenFGA, which are trending for Identity and Access Management (IAM) due to increasing authorization complexity. These declarative languages offer readable, performant, and auditable ways to manage fine-grained access controls across microservices, databases, and evolving user requirements, including AI agents. The article discusses authorization challenges, layered architectural principles for decision-making, and the benefits of policy-as-code. |
| 2026-04-22 2026 | OPA vs OpenFGA: A Technical Comparison of Policy Engines intermediate 11 min read | Reference comparing Open Policy Agent (OPA) and OpenFGA, two distinct policy engines. OPA, a CNCF project, uses Rego for centralized, rule-based access control, excelling in complex attribute-based decisions and infrastructure authorization like Kubernetes admission control. OpenFGA, based on Google's Zanzibar model, employs a tuple-based relationship approach for fine-grained, object-level permissions and hierarchical access, suitable for collaborative features and social network-style sharing. The comparison details their core concepts, architectural differences, and use case scenarios. |
| 2026-04-22 2026 | Implementing Google Zanzibar: A Demonstration of Its Basics intermediate 13 min read | Library demonstrating Google Zanzibar fundamentals, focusing on its Relationship-Based Access Control (ReBAC) model. The entry explores Zanzibar's data model, relationship tuples with examples like `file123#owner@alice`, and provides a PostgreSQL implementation for storing these tuples, illustrating concepts such as ownership and membership. |
| 2026-04-22 2026 | How to Protect Your API with OpenFGA: ReBAC Concepts to Practical Usage intermediate 13 min read | Library introducing Relation-Based Access Control (ReBAC) via OpenFGA, an open-source implementation of Google's Zanzibar concepts. It details ReBAC principles, contextual conditions, and attribute-based access, offering practical examples for protecting APIs and managing complex authorization logic. The library covers ReBAC concepts, OpenFGA's features like time-based and status-driven permissions, and contrasts its approach with traditional methods such as RBAC and ABAC, highlighting benefits in maintainability and scalability. |
| 2026-04-22 2026 | How Google Drive Models Authorization: A Look into Zanzibar intermediate 7 min read | Library implementing Google's Zanzibar authorization system, which utilizes relationship-based access control (ReBAC) to manage permissions for services like Google Drive. Zanzibar centers on user-resource relationships rather than roles, enabling complex, nested access models with high availability and low latency through its globally distributed database and consistency protocol, which employs timestamps and "zookies" to ensure accurate permission checks in distributed environments. |
| 2026-04-22 2026 | Common Bug Bounty Vulnerabilities: A Technical Deep Dive for Hunters in 2026 intermediate 7 min read | Reference outlining common bug bounty vulnerabilities, detailing techniques and tools such as local LLM integration with Ollama for response analysis, Burp Suite extensions like Authz and Turbo Intruder for IDOR testing, Interactsh for SSRF callbacks, sqlmap for SQL injection, InQL for GraphQL fuzzing, and Burp's DOM Invader for XSS, alongside methods for exploiting business logic flaws. |