A 404 that lies on purpose is more honest than a 403
Fixing a cross-tenant IDOR taught me that 'access denied' and 'does not exist' are the same message when the requester should never learn which one is true.
#security
2 posts tagged this topic.
The support ticket that tried to close its own prompt
AIDA classifies support tickets with an LLM, so the classifier has to treat every ticket as a potential attack. The fence around the ticket text is real, but it isn't the guarantee — the guarantee is that a successful attack still can't do anything.