API Security
API
REST, GraphQL and MCP APIs: broken object-level authorization, excessive data exposure, privilege escalation, and time-of-check/time-of-use race conditions in business logic.
- Arclight 2 Arclight 2 is the sequel to Arclight 1: same Flask + GraphQL stack, but now the flag lives behind a rootVault query that is "root tier only". A fresh account gets role: standard.
-
Arclight 1
Arclight is a Flask "staff portal". After registering and logging in you get a dashboard whose sections (Directory, Projects, Travel, Developer) each fetch /category/
and render tiny, sanitised JSON. The "Developer" section leaks the… - TradeBot TradeBot is not a normal web app: the health endpoint reveals a Model Context Protocol (MCP) server at /mcp. It exposes trading tools (get_stock_price, place_order, get_risk_report, …). There is a hidden restricted instrument FLAG…
No write-ups match your filter.