Pen-Testing My Own Upload Endpoint
Tried to path-traverse my own homework upload API. It held up, but only because of a timestamp prefix I never meant as a security thing.
Security
I Pulled /etc/passwd Off My Own Server
An nginx 400 felt like a fix. send_from_directory felt like a fix. Then a different endpoint handed me /etc/passwd, and the real question was how bad that actually is.
Before the First Container
Day zero of the online judge: can I even charge for it, how to split two free ARM boxes, not getting a surprise bill, and locking down SSH.