Pen-Testing My Own Upload Endpoint
Tried to path-traverse my own homework upload API. It held up, but only because of a timestamp prefix I never meant as a security thing.
Flask
I Pulled /etc/passwd Off My Own Server
An nginx 400 felt like a fix. send_from_directory felt like a fix. Then a different endpoint handed me /etc/passwd, and the real question was how bad that actually is.
Redoing the Schema for Weekly Student Reports
Turning one-off student comments into weekly cumulative reports for two programs with different calendars, and the upsert that would’ve silently doubled every comment.