networkshard
← all topics

/blog/tags/broken-authorization

broken-authorization

1 article

  1. One APK, 91 Gyms' Keys, and a Backend That Never Asked Who I WasI downloaded one gym app and walked away holding 90 other gyms' backend keys. Then the server behind it started handing out admin sessions and member records to anyone who knew a number. A story about white-label apps going brrr.9 min read