gRPC / Protobuf API attacks

When it applies

The target exposes gRPC (or grpc-web). Binary framing over HTTP/2 makes it feel opaque, but the same authz/injection bugs apply — and server reflection often hands you the whole API.

Why it works

gRPC methods are RPCs with typed messages; security still lives per-method. Reflection (if on) exposes every service/method, and teams frequently skip auth on internal-looking RPCs or trust the client-generated stubs to enforce access.