tahag.dev
topics

API and logic bugs

Where the client is trusted with a value the server should own, and what that is worth.

Posts in API and logic bugs

I could order anything on McDonald's for almost free. Here's the bug A delivery-fee field let the client set the McDelivery order total, down to almost zero. The APK also shipped the build report for its own front end. Reported to McDonald's India, fixed, and written up here. 9 min

filed under api bug-bounty logic-bug security

Type to search. Enter opens the top result.

/ openesc closeenter go