Part 1 covered the technical implementation of secure file upload handling in Java and Spring. It went through content validation with Apache Tika, path traversal defenses, generated filenames, image
Build web apps long enough and file uploads become unavoidable. Profile pictures. PDF invoices. CSV imports. Resume uploads. Log bundles for support. Every time an application lets users send bytes an
Part 1 covered horizontal privilege escalation and IDOR, walking through ownership validation, Spring Security method-level authorization, and the bypass techniques that keep showing up in assessments
Part 1 covered horizontal privilege escalation, where users access resources that belong to other users at the same privilege level. We walked through IDOR vulnerabilities in path parameters, query pa
Broken Access Control sits at the top of the OWASP Top 10 2025, and that ranking tells an important story. Authentication answers a simple question: who is this person? Authorization answers a harder
In Part 1 of this series, we cover OS command injection vulnerabilities from a developer's perspective. We looked at secure coding approaches with ProcessBuilder, whitelist-based validation strategies
