Comment by ofjcihen

Unfortunately for everyone, no.

I’ll give you an example of one that was written recently actually.

The initial compromise happened because the app explicitly did not verify auth claims when a specific string was in the ISS field. Well, fuzzers exist and are common.

The next issue was that once you’re in, there was no delineation between admin and regular users. Everyone had all privileges if they just made the calls.

Anyway, we did the usual post-remediation investigation and write up. The devs were of course using the latest models, as they were instructed, and the issue stemmed from a problem they’d been having integrating a specific company into their auth scheme.

Eventually, after many enumerations, the model opted to just skip auth altogether if that companies ISS was present. The devs, being in the habit of just accepting the changes did so and because of the nature of the code implemented nothing caught it in the pipeline.

This is sadly an incredibly common story and it won’t be fixed by models improving I don’t believe.