Application security

A request is not a permission.

Trace a worker’s identity, intended audience, requested action and destination. Find the exact check that changes the decision.

A signed request can still ask for the wrong thing. Follow the checks, not just the credential.

Field notes

Two boundaries worth testing.

Separate token verification, the receiving service and permission for a concrete action.

Read the case Egress

Evaluate an outbound origin, then test a redirect the first decision never covered.