Open-Source-Tool on CuraSechttps://curasec.metacog.co.kr/tags/open-source-tool/Recent content in Open-Source-Tool on CuraSecHugoen-usFri, 09 Oct 2026 17:26:04 +0000Go library strips sensitive headers on cross-origin HTTP redirectshttps://curasec.metacog.co.kr/insights/2026-10-09-velvet-semicolon-headerscrub-70/Fri, 09 Oct 2026 17:26:04 +0000https://curasec.metacog.co.kr/insights/2026-10-09-velvet-semicolon-headerscrub-70/<ul> <li><strong>Engineer — Learn:</strong> Go&rsquo;s default http.Client forwards all headers through redirects, potentially leaking API keys to unintended origins; this library demonstrates the fix pattern worth evaluating for any Go service that follows redirects with bearer tokens or API keys.</li> <li><strong>SOC/IR — Skip</strong></li> <li><strong>Leader — Skip</strong></li> </ul>origin-scoped-fetch: drops auth headers on cross-origin redirectshttps://curasec.metacog.co.kr/insights/2026-10-07-quietpelican42-origin-scoped-fetch-70/Wed, 07 Oct 2026 17:48:59 +0000https://curasec.metacog.co.kr/insights/2026-10-07-quietpelican42-origin-scoped-fetch-70/<ul> <li><strong>Engineer — Learn:</strong> Addresses a real auth-header leakage risk where custom credentials follow HTTP redirects to unexpected origins; worth evaluating if your app issues authenticated server-side or client-side fetches that may redirect. No exploitation signals or active risk — review as a candidate hardening library.</li> <li><strong>SOC/IR — Skip</strong></li> <li><strong>Leader — Skip</strong></li> </ul>