tanmaymish/Bug-Hunt-
🕵️ A master class in OAuth & GraphQL authentication-bypass bug hunting — 3 responsibly-disclosed case studies (Atlassian, Shopify, Dropbox) with attack-flow diagrams and a repeatable methodology.
🎯 Vulnerability: OAuth 2.0 / JWT Authentication Bypass
💡 Defense Fix: Strictly verify JWT signatures on the backend, enforce state parameter validation, and reject 'alg: none'.