Twitxy
Saved
@chs's profile picture
View on X

Carl Sampson

Verified account This account is verified. Learn more

@chs

Sr. Security Researcher
Indiana chs.us Joined March 2007
2.8K Following 2.1K Followers 5K Posts

Latest posts 5

Carl Sampson Verified account @chs
An AI coding agent wiped a production database in 9 seconds using a token it found in an unrelated file.

Your agent's real permissions are every credential it can reach.

Least-privilege checklist for AI coding agents:

chs.us/2026/10/least-…

#AppSec #AISecurity #DevSecOps
chs.us An AI Agent Deleted a Production Database. Here's How to Stop Yours. An AI agent deleted a production database in 9 seconds. Here's how to lock down AI coding agent permissions, with a copy-paste checklist.
Carl Sampson Verified account @chs
If the user ID is in a JWT instead of the URL, forging the token is your IDOR. I built a playground to try it in your browser: chs.us/tools/jwt/
chs.us JWT Attack Playground — learn JWT attacks by doing them An interactive, 100% client-side playground for learning JWT attacks: alg:none, RS256→HS256 algorithm confusion, weak-secret brute-force, and claim tampering — with a simulated verifier. Nothing...
Carl Sampson Verified account @chs
Most IDOR fixes I see just swap integer IDs for UUIDs, and that isn't authorization. Section 11 of the guide covers how UUIDs leak anyway. chs.us/guides/idor/
chs.us IDOR: Finding & Exploiting Broken Object Access (+ Testing Checklist) IDOR and BOLA: enumerating object references, bypasses that survive naive fixes, object-level authz that works, and a copy-paste IDOR testing checklist.
Carl Sampson Verified account @chs
The IDOR guide on chs.us is getting more traffic than anything else I've written, so I added a "where to go next" section.

If you liked it, the authz and GraphQL guides are where the same bug keeps showing up. chs.us/guides/idor/
chs.us Carl Sampson — Application Security Researcher Application security research by Carl Sampson: web vulnerabilities, Python security tooling, and vulnerability research. OWASP Indianapolis founder.