Anirban Banerjee
Research / Field notes

Field notes.

Public-safe analyses of the weakness classes I study. No target details, confidential reports, or operational material. The work begins with how a system is supposed to behave.

All notes

Newest first / 04 entries
01Access control

The object, not the endpoint

Object-level authorization fails when a route is protected but the thing behind it is not. The distinction is small, and the consequences rarely are.

IDOR / BOLA7 min read
02Business logic

When the business rule is the vulnerability

Some of the most consequential flaws contain no malformed input. The system does exactly what it was told, just not what it meant.

Workflow integrity8 min read
03Authentication

Permission is not authorization

A valid session answers who is asking. It does not answer whether this action is allowed, on this object, in this context, right now.

Sessions / privilege6 min read
04API security

Reading an API like a researcher

Before testing a single request, map what the API believes about identity, ownership, and sequence. The shape of those beliefs is where the work begins.

Surface analysis5 min read

These notes describe vulnerability classes in general terms. They are written to be useful to engineers and researchers without exposing confidential report contents or providing operational exploit instructions.

Publication

Public-safe by design.

A portfolio can demonstrate technical depth without disclosing information that belongs to a program, a client, or the people whose data was involved.

  • 01

    No confidential material

    Report contents, affected endpoints, proof-of-concept artifacts, customer data, and private correspondence stay private.

  • 02

    Educational, not operational

    Notes explain the shape of a weakness and the reasoning behind it, not step-by-step exploitation of a live target.

  • 03

    Clarity over spectacle

    Findings are described with the smallest useful level of detail, consistent with program policy and coordinated timelines.

Disclosure approachCorrections and context