The UnboundCompute blog
How web apps and APIs really break.
Clear, honest writing on web and API security. The common bugs, the ones automated scanners miss, and how a real finding is actually proven. Written for everyone from beginners to security teams.
What we write about
Vulnerability Basics
Plain explanations of how software actually breaks.
Access Control
Broken access control, IDOR, and who can do what.
Injection and Input
XSS, SQL injection, and untrusted input.
Scanners vs Research
Why scanners miss the bugs that matter.
Attack Teardowns
Step by step walkthroughs of real bug classes.
Latest writing
-
Security Agent Skills: Testing Method, Not Another Scanner
Security agent skills package a tester’s method, not a fixed script. Learn how they work, what the library covers, and how to run one with any agent.
-
AI SAST vs Traditional SAST
How ai sast differs from traditional rule based static analysis, why a model must be grounded in a deterministic graph, and how proof beats guessing.
-
Why SAST Tools Have So Many False Positives
Why sast false positives pile up: no reachability, unmodeled sanitizers, over approximation, framework blindness, dead code, and what cuts the noise.
-
Why SAST Misses Business Logic Bugs
Why sast business logic coverage falls short: static analysis matches dangerous code shapes, but logic bugs hide in the safe checks your app forgot to write.
-
Reachability Analysis and Whether a Bug Is Exploitable
Reachability analysis asks if attacker input can actually reach a flagged function, so you fix the real bugs and drop the theoretical ones.
-
How before_action Authorization Bypasses Happen in Rails
See how before_action authorization in Rails gets bypassed by skips, only and except scopes, inheritance, and callback order, and how to find the gap.