Imagine you have a shared property, a new person starts using it and was not made aware that there is a gate that closes the front side. So they open a high severity ticket with the landlord (a company managing multiple different properties) “the front side is wide open, anybody can come onto the property, we need a wall”…

Facility management checks out the surveillance camera and indeed, the entryway looks wide open. So they send out a worker to build a wall with a gate so people can go through.

Then another user of the property comes back, they happen to use the property with a group of RVs once a year for a week, they are now locked out from using the property because they can’t go through the wall (tearing it down requires a new work order).

I have encountered two situations like this today with software and wanted to rant about them:

The first example I have for this is soft-serve, which had a 9.1/10 security “issue” in 2025 because webhooks against internal URLs are working (yes, that seems to be the entire issue). Their “security fix” is to simply block any webhook that resolves against an “internal IP”, so any webhook against a non-internet address will always fail, with no way to override it (unless you code it).

The second example is Jenkins, which used to have a feature that a build can be triggered from a WebHook like <HOST>/job/<JOB>/build?token=<SECRET>, but for some reason this now requires a valid user (what is the point of the token???). Their “solution”? Install a separate plugin that adds an additional endpoint that offers the same functionality and use this plugin to trigger the job.

I fear that there are many more cases like this out there.

All the wasted time and effort, to build walls around open gates (instead of closing them when needed)…