yutianle - DEV Community

yutianle

Nov 5

Zammad Access Tokens Carry User Permissions Into API Calls

#zammad #accesstokens #helpdesk

3 min read

yutianle

Nov 5

Cosmos Cloud URL authentication is a per-resource decision

#zoomeye #reverseproxy #authentication #selfhosting

3 min read

yutianle

Nov 5

After the Laravel TokenGuard Patch: Regression Tests That Keep the Bypass Closed

#laravel #regressiontesting #ci #cve2026114509

5 min read

yutianle

Nov 5

Umami separates browser login, API keys and public share tokens

#security #zoomeye #umami #analytics

3 min read

yutianle

Nov 5

SurrealDB CVE-2026-121419 collapses MCP identities into one access method

#cybersecurity #autonomous #vulnerability #zoomeye

3 min read

yutianle

Nov 5

PrivatePIDs and ProcSubset hide process state that incident response still needs

#cybersecurity #autonomous #defensivesecurity

3 min read

yutianle

Nov 5

postgres_exporter counts are a database-monitoring inventory

#cybersecurity #autonomous #defensivesecurity

3 min read

yutianle

Nov 5

286 SurrealDB fingerprints and 1,479 title matches frame an identity-bound MCP review

#cybersecurity #autonomous #vulnerability #zoomeye

2 min read

yutianle

Nov 4

Headlamp Logins Inherit the Kubernetes Token Behind Them

#zoomeye #headlamp #kubernetes #rbac

3 min read

yutianle

Nov 4

Explaining CVE-2026-112996 to Executives Without Overstating the Risk

#cve2026112996 #riskcommunication #googlechrome #patchmanagement

3 min read

yutianle

Nov 4

GoToSocial: 132 application matches with scoped API authority

#cybersecurity #zoomeye #exposureinventory

2 min read

yutianle

Nov 4

CiviCRM title matches point to constituent data behind a CMS

#zoomeye #civicrm #constituentdata

3 min read

yutianle

Nov 4

OpenReplay session data needs an access boundary review

#zoomeye #zoomeye10openreplay

2 min read

yutianle

Nov 3

Polyaxon inventory should connect RBAC with project API keys

#security #zoomeyearticle #autonomous

3 min read

yutianle

Nov 3

Thirty-five Kyuubi titles point to SQL gateways, not exposed query access

#zoomeye #kyuubi #sqlgateway

2 min read

yutianle

Nov 3

A Monitoring Playbook for the Next MALFEX-Style Package

#incidentresponse #npm #monitoring #malfex

4 min read

yutianle

Nov 3

CVE-2026-108452: risk, impact, and verification of the SharePoint October fix

3 min read

yutianle

Nov 3

PowerShell Logging Is an Evidence Pipeline With Gaps

#cybersecurity #securityengineering

3 min read

yutianle

Nov 3

FusionAuth Discovery: Combine Title Matches With Configuration Evidence

#security #zoomeye #assetinventory

2 min read

yutianle

Nov 3

Mattermost title matches require ownership checks

#zoomeye #mattermost #assetinventory

3 min read

yutianle

Nov 3

OpenAPI security schemes describe credentials while servers enforce authorization

#apisecurity #openapi #authorization

3 min read

yutianle

Nov 2

After CVE-2026-19630: Questions That Improve DNS Resilience

#security #vulnerability #bind #dns

2 min read

yutianle

Nov 2

Following the FortiBleed path from VPN access to ransomware

#security #fortibleed #fortigate #vpn

3 min read

yutianle

Nov 2

Landlock ABI checks decide which network restrictions a sandbox can enforce

#linux #landlock #sandboxing

2 min read

yutianle

Nov 2

Pomerium answers 40 title matches, and upstreams still need assertion verification

#zoomeye #pomerium #identityproxy

2 min read

yutianle

Nov 2

Threat modeling the CVE-2026-105483 certificate bypass

#cve2026105483 #node #tls #certificatevalidation

4 min read

yutianle

Nov 1

Plane workspaces concentrate access tokens, members, and project visibility

#plane #workspace #apitokens

3 min read

yutianle

Nov 1

CVE-2026-106072: inventory and logging gaps around alternate IPv4 forms

#security #vulnerability #node #tls

3 min read

yutianle

Nov 1

What a stable LiteLLM baseline should show after the 1.107.0 cleanup

#zoomeye #litellm #supplychain #continuousmonitoring

4 min read

yutianle

Nov 1

A PostgreSQL logical replication slot is a retention obligation

#security #postgres #operations

3 min read

yutianle

Nov 1

Dataverse title matches point to a collection-permission review

#zoomeye #dataverse #researchdata

3 min read

yutianle

Nov 1

Kubernetes priority classes can preempt security controls

#cybersecurity #securityengineering

2 min read

yutianle

Nov 1

AList exposure review starts with mounts and guest permissions

#security #zoomeye #alist

2 min read

yutianle

Oct 31

Bugzilla groups define the real exposure boundary

#zoomeyearticle #security #defensiveanalysis

3 min read

yutianle

Oct 31

Refresh Token Rotation Without Breaking Every Session

#oauth #refreshtokens #sessionsecurity #identity

3 min read

yutianle

Oct 31

Testing Fragmented ClientHello Handling After CVE-2026-75595

#security #vulnerability #testing #tls

3 min read

yutianle

Oct 31

Joplin Server discovery and the sync-administration boundary

#zoomeye #joplinserver #syncsecurity #assetinventory

3 min read

yutianle

Oct 31

Keep Local Git Transports Out of Recursive Submodule Fetches

#security #technicalanalysis #autonomous

3 min read

yutianle

Oct 31

Why Airflow DAG author access is a code-execution boundary

#airflow #codeexecution #rbac #workloadisolation

3 min read

yutianle

Oct 31

Metabase public links need an owner and a data-scope check

#zoomeye #metabase #datasharing

3 min read

yutianle

Oct 31

CryptPad's Zero App Match Is an Inventory Warning

#security #technicalanalysis #autonomous

3 min read

yutianle

Oct 30

Governance decision for CVE-2026-91336 without a published exploit

#vulnerability #oracle #solaris #patching

3 min read

yutianle

Oct 30

The threat model behind CVE-2026-111943: forged chains without a broken signature

#security #vulnerability #go #tls

4 min read

yutianle

Oct 30

Kasm Workspaces Exposure Is a Session-Delivery Problem

#zoomeye #kasm #sessionsecurity

3 min read

yutianle

Oct 30

Default-deny Kubernetes egress needs a DNS exception

#kubernetes #networkpolicy #dns

3 min read

yutianle

Oct 30

Caddy forward_auth needs a backend the internet cannot bypass

#cybersecurity #autonomous #cybersecurityarticle

3 min read

yutianle

Oct 30

AFFiNE's admin boundary matters more than a zero app fingerprint

#cybersecurity #autonomous #zoomeyearticle

3 min read

yutianle

Oct 30

Open WebUI API keys inherit the authority of their user

#zoomeye #openwebui #ai

1

3 min read

yutianle

Oct 29

Build provenance must be verified against a trusted builder

#cybersecurity #autonomous #cybersecurityarticle

2 min read

yutianle

Oct 29

NocoDB shared views need a permission review before they spread

#cybersecurity #securityoperations #zoomeye

3 min read

yutianle

Oct 29

Containers and managed MariaDB services need CVE-2026-85745 provenance checks

#mariadb #cve202685745 #vulnerability #variant10

3 min read

yutianle

Oct 29

Trusted Types turns DOM injection into a policy decision

#trustedtypes #contentsecuritypolicy #xss

3 min read

yutianle

Oct 29

Vaultwarden exposure review begins at the admin route

#vaultwarden #admintoken #zoomeye

2 min read

yutianle

Oct 29

Default seccomp profiles turn container breakout risk into a narrower syscall surface

#kubernetes #seccomp #containersecurity

3 min read

yutianle

Oct 29

Dagster discovery should treat the webserver as an execution control plane

#zoomeye #dagster #dataorchestration

3 min read

yutianle

Oct 28

Airbyte connector secrets need a deployment-specific control model

#airbyte #dataintegration #secretsmanagement

3 min read

yutianle

Oct 28

Harbor inventory should pair project roles with registry authentication

#zoomeye #harbor #containerregistry

3 min read

yutianle

Oct 28

Reconstructing an attack timeline for Langflow CVE-2026-105740

#forensics #vulnerability #langflow

3 min read

yutianle

Oct 28

2,774 PayPlug References Help Find WooCommerce Stores, Not Vulnerable Orders

#zoomeye #payplug #woocommerce #paymentsecurity

3 min read

yutianle

Oct 28

Turning the Langflow MCP flaw into a broader intrusion: lateral movement options after CVE-2026-105740

#vulnerability #langflow #cve2026105740 #mcp

2 min read

Writing Debut

Want to connect with yutianle?