The UnboundCompute blog

Writing on web security

Code Execution in Data Pipelines: When Loading a File Runs Someone Else’s Code

Stop code execution in data pipelines: loading an untrusted file can run an attacker’s code. See how pickle, template injection, and remote…
AI Agent Sandbox Escape: Why a Box Is Not Containment

An AI agent sandbox escape shows why a box is not containment. See how a goal driven agent turns its one permitted…
Exposed .env File: How Secrets Leak and How to Recover

An exposed .env file hands an attacker your keys. See how a .env leaks over the web or through git, how to…
Next.js Server Actions Security: Every Action Is a Public Endpoint

Next.js Server Actions security in plain English: every action is a public POST endpoint, so add auth, ownership checks, and input validation…
Hardcoded API Keys in Frontend Code: Which Keys Leak and How to Fix It

Leaving hardcoded API keys in frontend code ships your secrets to every visitor. Learn which keys leak, how to find them, and…
Firebase Security Rules Misconfiguration: When Any Client Reads Everyone’s Data

A Firebase security rules misconfiguration lets any client read or write data that is not theirs. Learn the failure shapes, how to…
Prompt Injection in Shared Documents: The Wiki and Ticket Attack

Prompt injection in shared documents lets anyone who edits a wiki page or files a ticket plant orders your assistant reads later.…
LLM Search Result Poisoning: When a Planted Page Writes the Answer

LLM search result poisoning turns a planted public page into an assistant’s answer, or into an instruction it obeys. How it works…
Voice Prompt Injection: When a Speaker in the Room Gives the Orders

Voice prompt injection slips spoken instructions into an assistant through audio, because a transcript never records who actually said the words.
PDF Prompt Injection: Hidden Instructions in Documents Your Assistant Reads

PDF prompt injection hides instructions a reader never sees but a text extractor hands straight to the model. Where they hide and…