Posts tagged #seguranca

Aug 8, 20264 min read

A pentester read another customer's conversation — and I learned where the boundary lives

Two months after launch we hired an ethical hacker. He found two critical flaws. The worst was a conversation ID exposed in the front-end that gave access to another customer's data. The lesson is not about IDOR.

#seguranca
#arquitetura
#backend

Jul 25, 20266 min read

Tools as contracts: designing tools the agent won't misuse

An agent doesn't call your API because it read the code — it reads the description and decides. That's why every tool is a contract: what it does, inputs, outputs, errors, whether it's reversible, and whether it needs approval.

#agentes
#arquitetura
#seguranca