Carl Sampson

@chs

Sr. Security Researcher

Indiana

Carl Sampson
@chs
Oct 21
An AI coding agent wiped a production database in 9 seconds using a token it found in an unrelated file. Your agent's real permissions are every credential it can reach. Least-privilege checklist for AI coding agents: chs.us/2026/10/least-… #AppSec #AISecurity #DevSecOps
An AI Agent Deleted a Production Database. Here's How to Stop Yours.
From chs.us
5
Carl Sampson
@chs
Oct 16
Noblesville taxpayers kept their end of the deal - readthereporter.com/noblesville-ta…
Carl Sampson
@chs
Oct 9
If the user ID is in a JWT instead of the URL, forging the token is your IDOR. I built a playground to try it in your browser:
JWT Attack Playground — learn JWT attacks by doing them
From chs.us
Carl Sampson
@chs
Oct 9
Most IDOR fixes I see just swap integer IDs for UUIDs, and that isn't authorization. Section 11 of the guide covers how UUIDs leak anyway.
IDOR: Finding & Exploiting Broken Object Access (+ Testing Checklist)
From chs.us
Carl Sampson
@chs
Oct 9
The IDOR guide on chs.us is getting more traffic than anything else I've written, so I added a "where to go next" section. If you liked it, the authz and GraphQL guides are where the same bug keeps showing up. chs.us/guides/idor/
Carl Sampson — Application Security Researcher
From chs.us

Carl Sampson’s posts