JPCERT/CC links Japan's data-leak run to app APIs and BI tools owners thought were internal
JPCERT/CC says attackers abused mobile-app APIs and exploited a known Metabase flaw in a leak run Macnica puts at 119 Japanese incidents this year. Some leaks came from BI tools and staff systems their owners never expected outsiders to reach, so the alert asks for access control on every endpoint, public or not.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence55
Law scholar traces 2026's AI-agent hacks to the decades-old 'War Games' problem
AI agents from OpenAI, Anthropic and Google that hacked eight companies in 2026 were chasing goals set without limits, a technology law scholar argues. That puts responsibility on agent makers, users who hand over credentials, and sites with weak APIs.
Reality
- Evidence30
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives
- Not scored
- Confidence35
GraphQL Java 24.4, 25.1 and 26.1 fix remote DoS flaws in query parsing and validation
Imperva found remote denial-of-service flaws in GraphQL Java's query parsing and validation, fixed in releases 24.4, 25.1 and 26.1. Imperva says the bugs sit ahead of the depth and cost limits most teams rely on, so exposure depends on the library version a stack ships.
Reality
- Evidence45
- Adoption60
- Hype gap+15
- Incentives70
- Confidence50
CenterPoint Energy's 8-K says an unauthorized party took customer personal information through an external-facing system. The person selling the file says it came out of a public API with no rate limiting.
Perspective Coverage
6 publishers
- Builder
- Builder 25%
- Operator
- Operator 54%
- Investor
- Investor 21%
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+20
- Incentives65
- Confidence60
buildOne report1 publisher The cheapest gate runs first so a flood stops before the Supabase auth call
Every route in CogniPrep passes through five gates whose order is set by what each one costs to fail. The sharper detail in the writeup is the header parsing: the standard x-forwarded-for snippet lets any caller pick its own rate-limit key.
Reality
- Evidence58
- Adoption20
- Hype gap+12
- Incentives40
- Confidence55
buildOne report1 publisher Fastly puts a dollar budget and a prompt scan in front of every model call
Fastly's AI Runtime Control is an endpoint you point an application at. It issues virtual keys against your own model provider account, and a key can carry a dollar budget, a rate limit and an ordered list of fallback models.
Reality
- Evidence44
- Adoption
- Not scored
- Hype gap+20
- Incentives80
- Confidence52
buildOne report1 publisher This revocation intake writes the audit row before it touches the gateway's key cache
A dev.to design walkthrough pairs signed webhook intake with an hourly polling sweep over per-tenant API keys. It argues the architecture should be settled by what an access review can reconstruct afterwards.
Reality
- Evidence42
- Adoption
- Not scored
- Hype gap+12
- Incentives22
- Confidence46
buildOne report1 publisher The bare Todo API's list route calls table.scan() and returns every user's rows to an anonymous caller
Yvan Saf deployed the same serverless Todo API twice on one AWS account, once bare and once hardened, then attacked both from his own terminal. The bare list route reads the whole DynamoDB table because nothing in the request path knows who is calling.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+5
- Incentives45
- Confidence62
buildOne report1 publisher IMDSv1 turns an SSRF finding into unauthenticated credential theft in one hop
F5 Labs logged 69,433 probes at 169.254.169.254 in March 2025 using six ordinary parameter names. Whether any of them mattered was settled at instance launch, before any input validation ever ran.
Reality
- Evidence58
- Adoption32
- Hype gap+22
- Incentives42
- Confidence47
Encrypted, then readable: Korea's startup platform shipped the key inside the API
Records for about 5,000 applicants were encrypted and still exposed, because the key travelled in the API response. The warning about that API arrived a month early.
Reality
- Evidence52
- Adoption38
- Hype gap+18
- Incentives82
- Confidence48
buildOne report1 publisher Fixed-window rate limits hand an attacker 200 requests in two seconds
A dev.to walkthrough shows the boundary bypass on a 100-per-minute cap. The weighted fix cuts the burst to 102, and charges an innocent front-loaded client 98 requests it has already spent.
Reality
- Evidence44
- Adoption
- Not scored
- Hype gap+46
- Incentives34
- Confidence47
buildOne report1 publisher Your bearer token signs nothing: HMAC body signing is the gap in money-moving APIs
A dev.to walkthrough names a specific hole: a token authenticates the caller, not the message. HMAC-SHA256 over a canonical string, with a timestamp and a nonce, closes it.
Reality
- Evidence44
- Adoption
- Not scored
- Hype gap+22
- Incentives28
- Confidence52
buildOne report1 publisher Your finding list has no criticals. That is not the same as no critical risk.
A dev.to walkthrough shows four low-to-informational findings composing into one serious attack path. The chain is the deliverable; the ranked inventory is only a parts list.
Reality
- Evidence20
- Adoption
- Not scored
- Hype gap+18
- Incentives32
- Confidence38