English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Tools annual

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Tools monthly

Global: Zendy Plus monthly

Presents the access of premium content as premium feature

Premium Content

Global: Zendy Plus annual

Global: Zendy Free Plan

We conduct a large-scale measurement of developers' insecure practicesleading to mini-app to super-app authentication bypass, among which hard-codingdeveloper secrets for such authentication is a major contributor. We alsoanalyze the exploitability and security consequences of developer secretleakage in mini-apps by examining individual super-app server-side APIs. Wedevelop an analysis framework for measuring such secret leakage, and primarilyanalyze 110,993 WeChat mini-apps, and 10,000 Baidu mini-apps (two of the mostprominent super-app platforms), along with a few more datasets to test theevolution of developer practices and platform security enforcement over time.We found a large number of WeChat mini-apps (36,425, 32.8%) and a few Baidumini-apps (112) leak their developer secrets, which can cause severe securityand privacy problems for the users and developers of mini-apps. A networkattacker who does not even have an account on the super-app platform, caneffectively take down a mini-app, send malicious and phishing links to users,and access sensitive information of the mini-app developer and its users. Weresponsibly disclosed our findings and also put forward potential directionsthat could be considered to alleviate/eliminate the root causes of developershard-coding the app secrets in the mini-app's front-end code.

Measuring the Leakage and Exploitability of Authentication Secrets in Super-apps: The WeChat Case