Pen-Testing My Own Upload Endpoint
Tried to path-traverse my own homework upload API. It held up, but only because of a timestamp prefix I never meant as a security thing.
Path-Traversal
I Pulled /etc/passwd Off My Own Server
An nginx 400 felt like a fix. send_from_directory felt like a fix. Then a different endpoint handed me /etc/passwd, and the real question was how bad that actually is.