The UnboundCompute blog

Writing on web security

Vibe Coded App Security: What Can a Stranger Read Right Now?

Vibe coded app security in plain English: the five ways AI built apps leak data to strangers, plus checks you can run…
Password reset poisoning: how a genuine email hands over your account

Password reset poisoning sends a real reset email with a link pointed at the attacker. See how the token leaks and the…
HTTP Parameter Pollution: When One Request Says the Same Thing Twice

HTTP parameter pollution sends one parameter twice so a filter and the app read different values. See how it works and how…
SMTP Smuggling: The Email Spoof That Rides Past SPF, DKIM, and DMARC

SMTP smuggling slips a forged email past SPF, DKIM, and DMARC by making two mail servers disagree on where a message ends.…
DOM Clobbering: Manipulating a Page’s JavaScript With Markup Alone

DOM clobbering injects plain HTML whose id and name attributes overwrite the globals a page’s JavaScript trusts, slipping past sanitizers and CSP.
The Single Packet Attack: Making Web Race Conditions Reliable

The single packet attack removes network jitter so many requests hit the same check to action window at once, making a flaky…
MCP Command Injection: When a Tool Argument Becomes a Remote Shell

MCP command injection turns a tool argument into an executed shell command. Learn how prompt injection triggers it remotely and how to…
The SAML Authentication Bypass Behind SAP NetWeaver

A SAML authentication bypass lets a valid signature cover one element while the server reads identity from another. See how SAP’s flaw…
OIDC Authentication Bypass: Trusting a Token You Never Verified

An OIDC authentication bypass lets a forged JWT log in as an admin when an app reads token claims but never verifies…
Limit Overrun Race Conditions Explained

A limit overrun race condition lets an attacker fire parallel requests to beat a check then act window and redeem one coupon…