domains / families / security / hunt-write-gap

hunt-write-gap

separate

Hunt read-protected write-gaping endpoints. PATCH/POST/DELETE without authorization while GET is protected. Agnostic: Supabase, Firebase, REST, GraphQL.

When to use

• You have authenticated access to a target and can READ your own data (profile, settings, records), but need to test if you can MODIFY data beyond your authorization level. This is the #1 pattern in Supabase-backed SaaS and increasingly com…

When not to use

• Read-only data access
• Endpoints that do not accept write methods

Skill page

Source