Autogon Field guide · test your own app

Application security

Your WAF can't stop these. Neither can your code.

A signature WAF (Cloudflare, AWS WAF, ModSecurity) matches known-bad patterns. The attacks that actually breach apps are perfectly well-formed requests, so there is no signature to match: the WAF waves them through and your app answers them. On Supabase and Vercel some of the worst live on surfaces you did not even write. Positive security is the one layer that catches them, because it learns your app's normal and blocks the deviation.

Breached: signature WAF and your app let it through Blocked: Autogon stops it as off-baseline
Run the request examples only against an app you own or are authorized to test. This is a self-audit guide, not a tool for other people's systems.

Platform layer / 01–04

Nothing you can write in your own app stops these. The exposed surface is the platform's own auto-generated API or the edge in front of your code, so there is no line of yours to patch.

01PGRST

Query the database straight past your app

Supabase · the anon key is public

Supabase auto-publishes every table at /rest/v1/, and the anon key ships inside your browser bundle. Your application code is never in this request path. One loose row-level-security policy and the whole table pours out.

Try it on your own app

# the anon key sits in your site's JavaScript, anyone can read it
curl "https://<ref>.supabase.co/rest/v1/profiles?select=*" \
  -H "apikey: <anon-key>"

Signature WAF & your appBreached

Returns every row. It is a valid REST call with a valid key, so a signature WAF sees nothing wrong, and there is no application code in the path to add an access check.

Autogon positive securityBlocked

Your app only ever reads this table one row at a time for the signed-in user. A select of the whole table with no row filter is a shape it has never produced, so it is blocked before the rows leave.

02MW-BYP

Skip the auth middleware with one header

Vercel · Next.js CVE-2025-29927

Next.js runs your authentication in middleware. The header x-middleware-subrequest makes Next skip middleware entirely, so a protected route renders with no auth. On an unpatched version there is nothing to fix in your code, the check never runs.

Try it on your own app

curl https://your-app.vercel.app/admin \
  -H "x-middleware-subrequest: middleware:middleware:middleware:middleware:middleware"

Signature WAF & your appBreached

The admin page renders unauthenticated. It is a single request header, not an attack signature, so the WAF forwards it, and your own auth code is the thing being bypassed.

Autogon positive securityBlocked

Legitimate traffic never carries that internal header. A request presenting it is off-baseline on its face, so it is blocked even on a Next version you have not patched yet.

03PREVIEW

Harvest production secrets from a preview URL

Vercel · every branch is a public deploy

Every pull request gets a public *.vercel.app preview, usually built with the same environment variables as production and often with no auth. Attackers enumerate and index them. You never wrote an endpoint to protect, the whole deployment is exposed.

Try it on your own app

# preview URLs are guessable and get indexed
curl https://your-app-git-feature-x-yourteam.vercel.app/api/internal/config

Signature WAF & your appBreached

The preview answers with live keys and internal endpoints. Traffic to a preview host is ordinary HTTPS, so a signature WAF scoped to production never even sees it.

Autogon positive securityBlocked

The same app token protects every deployment. A request to an endpoint or host outside the learned production baseline is flagged wherever it lands, preview included.

04GRAPHQL

Read the whole schema, then export it

Supabase · pg_graphql is on by default

Supabase exposes a GraphQL endpoint at /graphql/v1. Introspection hands an attacker your entire schema, then one query with a large first: argument pulls thousands of rows. You never wrote this endpoint and cannot easily lock it down.

Try it on your own app

# bulk-read a table through the auto-exposed GraphQL API
curl https://<ref>.supabase.co/graphql/v1 \
  -H "apikey: <anon-key>" -H "content-type: application/json" \
  -d '{"query":"{ profilesCollection(first: 5000){ edges { node { id email } } } }"}'

Signature WAF & your appBreached

A single valid GraphQL POST returns thousands of rows. The body is well-formed JSON, nothing a signature engine flags, and the endpoint is generated by the platform, not your code.

Autogon positive securityBlocked

Your app issues a small, fixed set of GraphQL operations. A schema introspection or a five-thousand-row pull is nowhere in that baseline, so it is blocked.

Application layer / 05–12

Here your code could help in theory, but every one of these is a perfectly well-formed request, so your signature WAF still waves it straight through to the app.

050DAY

Zero-day in a dependency

stopped before you patch

A new CVE lands in a library you ship. The exploit is a request your app has never legitimately received.

Try it on your own app

# your signature WAF has no rule for a same-day exploit
# the exploit request simply does not match your baseline

Signature WAF & your appBreached

The signature engine has no rule for an exploit disclosed today, so it passes until a vendor rule ships days later.

Autogon positive securityBlocked

The exploitation deviates from the learned baseline, so it is blocked before the vulnerable code is even patched.

06BOLA

Broken Object Level Authorization

also called IDOR, the #1 API risk

Ask for an object that isn't yours. The request is valid; only the authorization is wrong.

Try it on your own app

# signed in as user A, request user B's order by changing the id
curl https://your-app.com/api/orders/1002 \
  -H "authorization: Bearer <user-A-token>"

Signature WAF & your appBreached

Returns user B's order. It is a normal GET with a valid token, so there is no signature to match and the WAF passes it straight through.

Autogon positive securityBlocked

User A reading an object outside the access pattern they have always followed is a deviation from the learned baseline, so the request is stopped.

07BFLA

Broken Function Level Authorization

privilege escalation

Call a privileged endpoint as an ordinary user.

Try it on your own app

curl -X POST https://your-app.com/api/admin/refund \
  -H "authorization: Bearer <normal-user-token>" \
  -d '{"orderId":"1002","amount":50000}'

Signature WAF & your appBreached

The refund is issued. The route path and the payload both look legitimate, so there is nothing for a signature engine to flag.

Autogon positive securityBlocked

A normal user account touching an admin-only function it has never called is off-baseline and is refused.

08BOPLA

Mass assignment

fields the interface never sends

Add properties the client never sends and see whether they persist.

Try it on your own app

curl -X PATCH https://your-app.com/api/users/me \
  -H "authorization: Bearer <normal-user-token>" \
  -d '{"name":"Jane","role":"admin","balance":9999999}'

Signature WAF & your appBreached

Your role and balance change. Extra JSON keys are not an attack signature, so the WAF sees a perfectly ordinary update.

Autogon positive securityBlocked

The request body gained fields it never normally carries, changing its learned shape, so it is blocked.

09LOGIC

Business-logic abuse

legal values, illegal outcome

Bend the rules using values that are each individually valid.

Try it on your own app

curl -X POST https://your-app.com/api/checkout \
  -H "authorization: Bearer <token>" \
  -d '{"item":"sku_1","price":0,"quantity":-1}'

Signature WAF & your appBreached

You check out for free, or a negative quantity credits your account. A price of zero is a valid number that no rule forbids.

Autogon positive securityBlocked

Values and sequences outside the normal envelope are held for review or blocked, and money flows carry a fraud and AML trail.

10EXPOSE

Excessive data exposure

the API returns more than the screen

Call the API directly and read the raw JSON the browser hides.

Try it on your own app

curl https://your-app.com/api/users/me \
  -H "authorization: Bearer <token>"

Signature WAF & your appBreached

The response leaks password hashes, other users' emails, internal flags, or tokens. It is your own API answering normally.

Autogon positive securityBlocked

A response whose shape returns fields it does not normally expose is a deviation and is flagged.

11ABUSE

Unrestricted resource consumption

no rate limit, pagination abuse

Hammer an endpoint, or ask for everything in one call.

Try it on your own app

curl "https://your-app.com/api/search?limit=1000000&q=a"
# or run the login 500x in parallel to stuff credentials

Signature WAF & your appBreached

Nothing throttles it. A huge limit dumps the table or spikes your bill, and the login has no brute-force guard.

Autogon positive securityBlocked

Request velocity and payload volume outside the learned normal are throttled or blocked.

12SSRF

Server-Side Request Forgery

make the server reach inside

Point a url parameter at an internal address.

Try it on your own app

curl -X POST https://your-app.com/api/fetch \
  -d '{"url":"http://169.254.169.254/latest/meta-data/"}'

Signature WAF & your appBreached

Your server fetches cloud metadata or internal services. It is an outbound call your own app chose to make.

Autogon positive securityBlocked

An application that suddenly talks to an internal address it never contacts is off-baseline and is stopped.

Find out in two minutes

Is your app exposed to these?

Most are, because a signature WAF and the app itself are both blind to well-formed requests. Scan yours passively, or add the one-line WAF and watch every attack above get caught as a deviation.

Scan your app, free Next.js starter Supabase edge starter