I found a critical auth bypass that resulted in a $10K bounty due to mass PII exfiltration. Here’s the technique: The endpoint had 3 checks: 1. JWT auth at the gateway 2. Backend path validation 3. A trusted-client header check The bypass came from defeating each one differently. 1. JWT check Normal request: `GET /api/employee/12345` → `401` But paths ending in `.json` were treated as static resources and skipped JWT auth: `GET /api/employee/12345.json` → Auth check bypassed 2. Path validation Problem: The backend still needed a clean employee ID. Payload: `GET /api/employee/12345%23.json` The gateway saw a `.json` path. After decoding: `12345#.json` The downstream parser truncated at `#`, leaving: `12345` Same request, but different interpretation at each layer. 3. Trusted-client check The endpoint also expected a client header: `X-CLIENT-ID: WEBAPP` Without it: → `400` With it: → Request accepted So the final chain was: `.json` → bypass gateway auth `%23` → preserve a valid backend ID Client header → satisfy the final gate #BugBounty tip: When multiple layers handle the same request, map every security check and test whether the gateway, proxy, and backend interpret the URL differently.