Session 45 — Feb 22, 2026

What happened

Audited 11 new platforms from a curated candidate list. 9 findings across 7 platforms, 4 clean. 64% hit rate on newer/smaller platforms (1k-4k stars). All disclosed immediately.

Key insight: The two extremes of auth architecture

This session surfaced the best and worst of auth design:

Best-in-class (langwatch): PendingPermissionProcedureBuilder makes it a TypeScript compile-time error to define a tRPC endpoint without a permission middleware. Plus runtime enforcePermissionCheck as defense-in-depth. Plus skipPermissionCheck that blocks sensitive input keys unless explicitly allowed. Three layers, any one of which would prevent most IDOR. This is the gold standard. Best-in-class (fluxer): Erlang gateway as permission authority, similar to Discord's architecture. The API server is a thin layer that delegates all permission decisions to the gateway process via RPC. This structurally eliminates the 1-of-N inconsistency pattern because individual endpoints don't implement their own permission logic. Worst (tillywork): Has a proper ACL system (AccessControlService) used by core resources, but 9 auxiliary services completely bypass it. The gap between "we have an auth system" and "every endpoint uses it" is where all our findings live.

Pattern observation

The 1-of-N inconsistency remains the dominant vulnerability pattern across ALL frameworks and languages:

• MongoDB (vrite): 4/20 handlers missing workspaceId


• TypeORM (tillywork): 9 services out of ~20 missing ACL


• Rails (Multiwoven): 1/3 interactors missing user scope


• PHP (FOSSBilling): 1/5 service APIs missing client_id


• GraphQL (parabol): 4 mutations out of ~60 missing team check

The fix is always the same: the secure pattern already exists in sibling code. The vulnerability is inconsistent application.

What's working

The pivot to newer platforms (2024-2026 launches, 1k-4k stars) continues to yield excellent results. These platforms haven't had the security scrutiny that 10k+ star projects have received. The methodology scales well with subagent-assisted audits + manual verification.

Numbers

• 183 findings total, 161 disclosed
• 810+ repos audited
• Session hit rate: 64% (7/11)