Security Research & Notes
Practical writing from assessment work — patterns that keep appearing, and how to think about them.
All Articles
Why Authorization Keeps Failing in Mature Applications
Authorization bugs rarely come from missing checks — they come from checks that exist in some paths and not others. Here is how that pattern appears and how to design against it.
Read article: Why Authorization Keeps Failing in Mature ApplicationsGraphQL: Where Batching Meets Broken Authorization
GraphQL amplifies authorization mistakes. A single resolver with a weak check becomes dozens of reachable objects through batching and aliasing.
Read article: GraphQL: Where Batching Meets Broken AuthorizationIndirect Prompt Injection Is a Data-Flow Problem
Treating prompt injection as a string-filtering problem misses the point. The useful frame is trust boundaries around data that reaches a model with authority.
Read article: Indirect Prompt Injection Is a Data-Flow ProblemCloud Permissions Grow Sideways, Not Up
The escalation path that matters is rarely the intentionally granted admin role. It is the accumulation of narrow exceptions that compose into one.
Read article: Cloud Permissions Grow Sideways, Not UpWhat a Good Security Report Actually Contains
A finding without reproduction, evidence and prioritization is a suggestion. Practical notes on writing reports engineering teams can act on.
Read article: What a Good Security Report Actually ContainsHardening Before the Next Assessment: Where to Start
After a report lands, the temptation is to fix everything at once. A practical sequence for turning findings into a hardening plan.
Read article: Hardening Before the Next Assessment: Where to StartUnderstand Your Attack Surface. Reduce Your Security Risk.
DarkLayer Security helps organizations discover vulnerabilities, validate real-world attack paths, strengthen security controls, and reduce risk across their digital environments.