Developer finds three security flaws in his own hackathon project within ten minutes

A developer revisited code he wrote in February for a satellite-based deforestation detection tool called Sentinel Eye, this time reading it through the lens of an attacker after completing an ethical hacking course. Within ten minutes he identified an Insecure Direct Object Reference (IDOR) flaw in the file download endpoint, where the server accepted any S3 key supplied by the client without verifying ownership. He also discovered that both the analyze and download API endpoints were deployed with no authentication whatsoever, leaving them open to the entire internet. The analyze endpoint was particularly risky because it triggered calls to a paid satellite imagery API and spun up an EC2 instance, meaning anyone could have generated costly cloud charges. The developer documented the vulnerabilities to illustrate how security shortcuts common in hackathon environments can produce serious real-world risks.