I have hit one of the dangerous mistakes a Developer can do

As you see here the API is rejecting all the requests without Authorization header but after adding a fake one it returns the data

This vulnerability is classified as BFLA/BOLA API1:2023
(Broken Function/Object Level Authorization) or a Broken Access Control (BAC) issue at all

You can read more about it on OWASP API Top 10

API1:2023 Broken Object Level Authorization

#API_Security

@reverseengineer101

Happy to say that I have won 🎉 🥳

My write-up came as the second best write-up
Check the post comments on X
https://x.com/i/status/2026660723707855146

Check all the write-ups here (mine is the 5th)
https://bugology.intigriti.io/intigriti-monthly-challenges/0226

@reverseengineer101

We are now in the age of Vibe Coding, it's great and everyone in tech feild should use AI in his work and if not he will not equalify his mates in the field or lose his job

But, when it comes to security concerns every developer or organization shall not relay on the AI code generated because it really can cause massive damages or manipulations on their business logic or lose thousands of dollars

The screenshots here is showing a real case found on the wild (my own security researchs) where the developer stored AES Encryption Keys in different places in the code without obfuscation which are responsible to encrypt and decrypt sensitive information like PIN used to unlock users' wallets and other storage that shall be secure by encryption algorithms but unfortunately the keys are exposed

Usually when I see emojis inside a code (like ✅ and ❌❎) I understand it was written by AI or this code wasn't written by a professional developer so I start my investigations from that point

@reverseengineer101