mass-assignment

Simple Authorization via PHP Classes

Declarative validation for Go maps & HTTP JSON/multipart payloads — nested objects, lists, conditional rules, whitelist struct binding. No struct tags.

Educational Express API security lab: response filtering, role-based authorization, owner checks, mass-assignment protection, OpenAPI, Postman, and automated tests.

Walkthrough demonstrating real-world exploitation and mitigation of critical API security flaws (Mass Assignment to Logging & Monitoring).

Expected attribute values for Pundit strong parameters — declare allowed per-attribute scalar values in your policies, alongside expected_attributes.

Attack an API from one pasted cURL: JWT tampering, mass assignment, auth bypass, IDOR — OWASP API Top 10 coverage, SARIF for CI

Validate request bodies with the Mongoose schema you already have: per-route allowlists, strict types, your schema's own rules.

A simple task list app, with completion mark, user input & form validation. Basic routing and controllers, Blade templating, database interactions with Eloquent ORM, CRUD operations, form validation, session handling

Static-analysis CLI (GitHub Action) that flags client-controlled tier/plan/role values reaching an entitlement decision without Stripe-webhook-verified gating.

DEMO for ASP.NET Worst Practices sessions

Opinionated fork of strong_parameters for Rails, Sinatra, Hanami, Rage, or plain Ruby.

Spring boot application developed to learn how to use the framework and understand how vulnerabilities are manifested in the application and how to prevent them.

Mass-assignment probe — re-sends a captured create with extra fields and emits a PoC curl per stuck field.

VAPT Master Checklist for web application vulnerabilities, including detailed checklists and techniques for various attack vectors.

Evidence-driven API authorization security auditing tool for BOLA, IDOR and Mass Assignment testing.