What is BOLA? Broken Object Level Authorization explained
A clear introduction to Broken Object Level Authorization (BOLA), why it tops the OWASP API Security list, how it happens, and how to reason about it.
CyberSecFix
Research
Original security research and technical deep dives.
Least privilege in cloud IAM: a practical mental model
Least privilege is easy to state and hard to operate. A practical model for scoping cloud identities, permissions, and trust relationships.
IDOR vs BOLA: are they the same thing?
IDOR and BOLA describe closely related authorization failures. This piece clarifies the terminology and when each label is the more precise one.
Prompt injection: the input-trust problem for LLM applications
Prompt injection is the LLM-era manifestation of a classic problem: mixing untrusted input with trusted instructions. An introduction for builders.
Model supply chain risk: what you inherit when you pull a model
Downloading a model is a supply-chain decision. What to consider about provenance, serialization formats, and the code that runs at load time.