The UnboundCompute blog

Writing on web security

GitHub Actions Security Explained

GitHub Actions security explained: how workflows get exploited through pull_request_target, script injection, and leaked secrets, and how to fix each one.
CI/CD Pipeline Security Explained

CI/CD pipeline security explained: why your build holds the keys, the main risk areas, and the plain defenses that keep a poisoned…
JWT jku Header Injection Explained

JWT jku header injection lets a token name its own verification key. See how the attacker hosts a JWKS, forges admin claims,…
Grep vs a Code Graph for Finding Bugs

grep matches characters, semantic code search matches meaning. See where plain text search fails and how a code graph finds the path…
Static Analysis False Negatives: The Bugs SAST Misses

Static analysis false negatives are the real bugs a scanner stays silent on. Learn the five causes, why silence beats noise, and…
Symbolic Execution Explained

Symbolic execution runs code with symbols for any input, records a path constraint at each branch, and solves for the exact input…
Why Sanitizers Get Bypassed

A sanitizer bypass slips past cleaning that looks correct. Learn the real causes, wrong context, bad order, blocklist gaps, and how to…
The Program Dependence Graph Explained

A plain guide to the program dependence graph, its data and control dependence edges, and how backward slicing reveals what can affect…
Points-to Analysis for Security

Points-to analysis tells a security tool which objects a name can point to, so it can separate a real bug from a…
Call Graph Analysis Explained

Call graph analysis maps which function calls which, so a bug that crosses functions stays visible. See why direct calls are easy…