When IP Whitelisting Isn't What It Seems: A Real-World Case Study from the Binance API
A case study on how Binance's listenKey design bypasses IP whitelisting, why Bugcrowd dismissed it, and what this teaches us about API secur...
Sep 21, 2026
7 min
Binance Fixed the IP Whitelist Gap. The Disclosure Process Is Still Broken.
I wanted to re-open an old Binance API security issue. Not because I enjoy re-litigating old reports. Because the last thirteen days made th...
Sep 21, 2026
8 min
Four Ways a Refresh Token Request Fails — Only One Means Trouble
A refresh token system where every token is single-use and belongs to a token family. Invalid, expired, and revoked are routine. Reuse means...
Jul 7, 2026
7 min
Rate Limiting Alone Won't Stop a Patient Attacker
IP-based throttling and account-based lockout solve different problems and neither substitutes for the other. Built and tested in NestJS: th...
Jul 2, 2026
6 min