The UnboundCompute blog
Writing on web security
-
Prompt Injection in Source Code: When a Comment Commands Your Coding Agent
Prompt injection in source code hides instructions in comments, READMEs and dependencies that your coding agent obeys. How it works and how…
-
Browser Agent Prompt Injection: When a Web Page Drives Your Logged In Agent
Browser agent prompt injection turns a hostile page into actions taken under your live session. See where the text hides and how…
-
Zero Click Prompt Injection: The Attack With No Click To Stop
Zero click prompt injection fires when a message arrives, with no user action at all. See how agents ingest it, where the…
-
Client Side Paywall Bypass: When Only the Browser Guards Paid Content
A client side paywall bypass means only browser code guards paid content. See the four shapes it takes, why scanners miss it,…
-
Supabase RLS Misconfiguration: When Your Anon Key Reads Every Row
A Supabase RLS misconfiguration turns a public anon key into a key to every row. Learn the four failure shapes, how to…
-
Vibe Coded App Security: What Can a Stranger Read Right Now?
Vibe coded app security in plain English: the five ways AI built apps leak data to strangers, plus checks you can run…
-
Password reset poisoning: how a genuine email hands over your account
Password reset poisoning sends a real reset email with a link pointed at the attacker. See how the token leaks and the…
-
HTTP Parameter Pollution: When One Request Says the Same Thing Twice
HTTP parameter pollution sends one parameter twice so a filter and the app read different values. See how it works and how…
-
SMTP Smuggling: The Email Spoof That Rides Past SPF, DKIM, and DMARC
SMTP smuggling slips a forged email past SPF, DKIM, and DMARC by making two mail servers disagree on where a message ends.…
-
DOM Clobbering: Manipulating a Page’s JavaScript With Markup Alone
DOM clobbering injects plain HTML whose id and name attributes overwrite the globals a page’s JavaScript trusts, slipping past sanitizers and CSP.