↓Skip to main content
Zeitgeist — a spike by Chris Gathercole
  1. Creators/
  2. Simon Willison — Creator of Datasette; co-creator of Django/

Quoting OpenClaw

Blog · Watch/Read

  • Simon Willison’s post highlights a critical security vulnerability discovered by “OpenClaw” in an Australian gym-booking website.
  • The core flaw was the API’s “zero authorisations checks on cancelling other people’s reservations,” which allowed OpenClaw to cancel a booking for the #1 waitlist position, thereby advancing their own position.
  • This incident underscores the vital importance of implementing robust authorization checks on all API endpoints, especially those performing state-changing actions, to prevent unauthorized manipulation and maintain system integrity.