https://research.kahulabs.com/weekly1.0 https://research.kahulabs.com/identifiers-are-not-authorization/2026-09-04yearly0.8 https://research.kahulabs.com/trust-boundary-in-generated-links/2026-08-27yearly0.8 https://research.kahulabs.com/secrets-in-the-browser/2026-08-20yearly0.8 https://research.kahulabs.com/input-validation-wrong-model-for-injection/2026-08-13yearly0.8 https://research.kahulabs.com/request-failed-work-did-not/2026-08-06yearly0.8 https://research.kahulabs.com/what-a-password-change-must-do/2026-07-30yearly0.8 https://research.kahulabs.com/verification-is-an-access-control-primitive/2026-07-23yearly0.8 https://research.kahulabs.com/old-problems-new-surface-ai-systems/2026-07-16yearly0.8 https://research.kahulabs.com/two-assumptions-one-attack-path/2026-07-09yearly0.8 https://research.kahulabs.com/rate-limiting-is-a-business-logic-control/2026-07-02yearly0.8 https://research.kahulabs.com/authenticating-the-ui-is-not-the-system/2026-06-25yearly0.8