https://pepdep.com Security research and write-ups. en https://pepdep.com/posts/two-parsers-one-signature https://pepdep.com/posts/two-parsers-one-signature Mon, 03 Aug 2026 00:00:00 +0000 Intigriti challenge 0726. A duplicate key in a signed JSON manifest let an ordinary account pull a report out of a namespace it was never granted. The signature stayed valid the whole way through.