During an authentication security assessment, we discovered that the login endpoint's rate limiting was configured with per_edge counting on the CDN/WAF layer. The protection only triggered when concurrent connections exceeded a threshold (~30-50 simultaneous requests). By sending sequential requests—one at a time, waiting for each response—an authenticated attacker could perform unlimited login attempts without triggering any security controls.

During a web application security assessment, we discovered that the /app/assets/i18n/en.json endpoint—intended for UI localization—was publicly accessible without authentication. The file contained far more than translation strings: it exposed 133+ internal database field names, entity structures, and business operation labels. A simple curl request returned 40KB of internal system metadata that directly mapped to the application's data

During assessment for one of our web clients, we discovered that the server reflected any Origin header value in its CORS response, combined with Access-Control-Allow-Credentials: true. This configuration allowed any external website to make authenticated requests on behalf of logged-in users. An attacker hosting a malicious page could silently fetch sensitive data from the application using the victim's session cookies.