Most security material is built on theory and checklists, but real vulnerabilities rarely look like the textbook example. Usually it’s a small detail somebody overlooked — unnoticed by code review and tests until someone else asks, “why does this even work?”. This talk is a collection of real cases I’ve found or had the chance to observe over the years — in mobile apps, open source projects and the infrastructure around them. You’ll leave with a sharper eye for bugs that can hide in plain sight in your own projects, and a handful of practical takeaways for everyday security work.
Outline:
- Introduction — where security bugs that “weren’t supposed to be there” come from.
- A review of selected cases from real projects — mobile apps, open source and surrounding infrastructure; everything authentic, anonymized where needed.
- Practical conclusions — what these stories teach and how to build vigilance for similar bugs in your own projects.