sharp-edges

Insecure authentication and authorization design patterns enable attacks such as IDOR via untrusted lookups, MFA bypass through frontend-only enforcement and weak device-token derivation, and account takeover via predictable, non-invalidated recovery codes with unlimited guessing attempts. The threat arises from broken authn/authz design, not from supply-chain malware or payload execution.