Post #1590306
2026-04-12 14:34 UTC
@hugovk @yossarian It's kind of a variant on "No vulnerability outside of usage", since "We used an API with an explicit security disclaimer in a security sensitive context" *is* a vulnerability, but the mere existence of APIs that are designed solely for trusted input is *not* a vulnerability. Not quite the same situation as the examples given, but similar.
Replies (1)
-
@joshbressers@infosec.exchange 2026-04-12 16:10
@ancoghlan @hugovk @yossarian In the case of a documented unsafe feature it’s a vulnerability in the caller But I also think such features should be removed instead of just documented. Especially now as lots of developers are using an LLM and not reviewing the code