PRAE / Failure Ledger
Failure Ledger
A growing, sourced research collection: software failures that teach a control, each with what happened, what the source establishes and what is still unknown.
Each entry records two things separately: what kind of event it was, and the basis for what the entry says. Capturing a primary source is not the same as observing the event, and the labels keep that visible.
| Event type | Meaning |
|---|---|
| Reported incident | An organization, regulator or court reports that a failure affected real systems or people. |
| Disclosed vulnerability | A flaw published through an advisory or CVE record. Exploitation is not implied. |
| Researcher demonstration | A researcher showed a failure could be exploited, usually on a sample or their own accounts. Harm to others is not implied. |
| Reproduced by PRAE | PRAE reproduced the failure itself, on its own fixtures or with written permission. No entry carries this label yet. |
| Source basis | Meaning |
|---|---|
| Primary source | The entry rests on the reporting organization’s, regulator’s, court’s, researcher’s or vendor’s own publication. |
| Secondary source | The fact comes from reputable reporting that cites a primary source PRAE could not capture. |
| Claimed | The only source is a threat actor, a leak site or an unconfirmed report. Claimed facts are never written as facts. |
How entries are written
Each entry records the event and its date, the source, the affected conditions, what happened, why it matters, what to check, remediation context, evidence and limits, and related resources. Historical remediation details are context, not current patch advice; check the vendor’s current guidance before acting.
Entries cover different languages, platforms, infrastructure, identity, data and AI systems as the collection grows. It does not promise coverage of every significant incident, continuous monitoring or alerts.
Entries
-
NS-FL-0001Disclosed vulnerability
Primary sourceWhen middleware carries the authorization boundary
Next.js disclosed a flaw that could bypass authorization performed in middleware. Which runtime and host served the app decided exposure.
-
NS-FL-0002Researcher demonstration
Primary sourceA public key met an open data boundary
Wiz reported unauthorized reads and writes in Moltbook’s Supabase deployment. The access policies, not the presence of a publishable key, were the central issue.
-
NS-FL-0003Researcher demonstration
Primary sourcePublic issue text redirected an agent into private repositories
In a controlled setup, an agent read a malicious public issue, pulled private repository data and published it in a public pull request.
Three founding entries, reviewed 29 October 2026. This is not a complete incident feed or continuous monitoring. Each entry maps its lesson to controls in the draft PRAE Standard; a mapping does not establish that any application meets a control. To report an error, use the contact form and choose “A correction to our research.”