Blog
Technical notes on security research, backend engineering and blockchain systems.
Cross-site GET reached the authenticated post-preview path on bitcointalk.org
A missing session check on the SMF post-preview path let a plain cross-site GET render attacker-supplied content in a logged-in user’s session. Remediated by the operator, bounty paid.