Security Research

Reading a failed control

What a broken access check looks like once the request has already succeeded.

What failed

The control accepted the request because the check ran after the write. The record was already stored.

What we kept

The useful result is the sequence, not a product claim. The same pattern shows up when authorization is added late.

All articles