41554 blogs · [ { "id": "01a08724-b621-72f3-af99-49d90cc6bd80", "title": "How a Blackstone real estate company exposed Social Security digits, dates of birth, addresses, and other applicant data through a GraphQL authorization flaw", "url": "https://alexschapiro.com/security/vulnerability/2026/07/16/beam-living-graphql-data-exposure.html", "published_at": "2026-08-24T09:00:00+00:00" }, { "id": "01a08724-b621-72f3-af99-49d90d629854", "title": "How I Reverse Engineered a Billion-Dollar Legal AI Tool and Found 100k+ Confidential Files", "url": "https://alexschapiro.com/security/vulnerability/2025/12/02/filevine-api-100k.html", "published_at": "2025-12-02T09:00:00+00:00" }, { "id": "01a08724-b621-72f3-af99-49d90e161e92", "title": "Brute-Forceable Airline Reservation API Left Millions of Passenger Records Vulnerable", "url": "https://alexschapiro.com/security/vulnerability/2025/11/20/avelo-airline-reservation-api-vulnerability.html", "published_at": "2025-11-20T05:00:00+00:00" }, { "id": "01a08724-b621-72f3-af99-49d90e219427", "title": "How Broken OTPs and Open Endpoints Turned a Dating App Into a Stalker’s Playground", "url": "https://alexschapiro.com/security/vulnerability/2025/04/21/startups-need-to-take-security-seriously.html", "published_at": "2025-04-21T12:30:00+00:00" } ] posts Claim your blog

Blog · corpus.blog/blogs/alexschapiro.com/posts

alexschapiro.com

2026

How a Blackstone real estate company exposed Social Security digits, dates of birth, addresses, and other applicant data through a GraphQL authorization flaw original ↗

24 Aug 2026

2025

How I Reverse Engineered a Billion-Dollar Legal AI Tool and Found 100k+ Confidential Files original ↗

2 Dec 2025

Brute-Forceable Airline Reservation API Left Millions of Passenger Records Vulnerable original ↗

20 Nov 2025

How Broken OTPs and Open Endpoints Turned a Dating App Into a Stalker’s Playground original ↗

21 Apr 2025