Security field notes

Understand the bug. See the exploit. Ship the fix.

Practical guides to real-world web vulnerabilities, written by the team building the scanner that finds them.

50 deep-dives16 vulnerability topicsFollow via RSS

Find a vulnerability guide

Search by vulnerability, technique, tag, or plain-language symptom.

All SQL Injection 8 Cross-Site Scripting 6 Insecure Deserialization 5 GraphQL 4 SSRF 4 XML External Entity 4 Command Injection 3 NoSQL Injection 3 Path Traversal 3 Host Header Injection 2 Open Redirect 2 Remote Code Execution 2 CORS Misconfiguration 1 CRLF Injection 1 LDAP Injection 1 Server-Side Template Injection 1

Tagged #api-security · clear filter

Start here{ __schema { types { name } } }

GraphQL4 min read

GraphQL API Security: Introspection, Deep Queries and the Authorization Gap

GraphQL hands clients a flexible query language — and hands attackers a map of your whole schema if you let it. Here is how introspection, query abuse and missing authorization go wrong, and how to lock the endpoint down.

SelfSec TeamJun 23, 2026