Renaming a shared tag can edit records the user can't open
Tags and labels are often stored once per workspace and joined to records through a tag_id. The rename endpoint checks that the caller can manage ta…
DevOps
⚑ Report a ProblemLatest DevOps news from Tech News
All topics
agents
ai
api
architecture
automation
aws
backend
beginners
cloud
database
devchallenge
devops
docker
javascript
kubernetes
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
testing
tutorial
typescript
webdev
Authorization at the Object Level: Testing for BOLA Before Someone Else Does
Authorization at the Object Level: Testing for BOLA Before Someone Else Does Broken object level authorization is consistently at the top of the OWA…
API Security: The Attack Surface That Grows Without a Firewall
API Security: The Attack Surface That Grows Without a Firewall Every new application feature tends to arrive as an API endpoint. Mobile clients, par…
Trusted AI Agent Transactions, Part 4: PingAuthorize Policy Decisions
Making policy decisions with PingAuthorize Part 3 established the transaction context and immediate caller identity. Authorization still needs to an…
🚨 10 Authorization Anti-Patterns I Keep Finding in Laravel Apps (And the One-Line Fixes That Save Them)
TL;DR: After reviewing hundreds of Laravel codebases, the same 10 authorization mistakes show up again and again. This article walks through each an…
5 Laravel Authorization Problems You're Probably Facing (And How to Solve Them in 2026)
TL;DR: Most Laravel apps hit the same 5 authorization walls as they grow — role explosion, exception handling, multi-tenancy, contextual permissions…
RBAC and Policy-Based Authorization: Controlling Access by Role and Rule
RBAC and Policy-Based Authorization: Controlling Access by Role and Rule A practical guide to authorization models — Role-Based Access Control (RBAC…
SaaS Security Best Practices: Auth, Authorization, and Data Protection
Security is not a feature — it is a property of your entire architecture. This guide covers the security practices implemented in production SaaS ap…
A Deactivated Admin Could Still Use Their Token. That's When Dual-Mode JWT Stopped Being About Speed.
What building cross-service RBAC taught me about the difference between a fast check and a correct one VaultPay is a wallet microservice I built on…
Introducing Zopa: a 60 KB authorization engine for proxy-wasm, written in Zig
There are plenty of times you want to delegate "let this request through, or block it" to a wasm filter inside Envoy. API gateways, service mesh bou…
Authorization at Scale: Access Levels, Roles, and Compact Decisions
Authentication answers "who are you?" Authorization answers the harder question: "are you allowed to do this?" By the time a request reaches this st…