Case studies.

Multi-step API workflow allowed a state transition that bypassed authentication checks under a specific request-ordering condition. Reproduction required a controlled race window; validated across staging and production replicas without service impact.

Historical certificate transparency records exposed a direct-reachable origin IP behind the CDN edge. Coordinated origin rotation and CDN-scoped firewall rules restored the intended trust boundary.

Unbounded resolver fan-out enabled cheap client requests to consume disproportionate backend resources. Depth and cost analysis were rolled out alongside a dedicated analytics read replica.

Domain separator was reused across mainnet and an L2 deployment, permitting silent replay of user signatures across chains. Domain re-binding and outstanding-signature invalidation were shipped without user friction.

The wallet-connect handshake accepted a pre-issued session token under a narrow timing window, allowing session fixation across dApp origins. Session rotation and origin-bound challenge nonce restored the trust boundary.

A bridge message format omitted the source-chain identifier from the signed payload, allowing valid messages to be replayed across bridge endpoints. Payload versioning and inclusion of a chain discriminant closed the gap.

Instantaneous oracle reads were used at a critical margin-check boundary. Introduction of a time-weighted median and a divergence guard against a secondary source removed the single-block manipulation surface.