https://trustboundarystudio.com/2026-09-09weekly1.0https://trustboundarystudio.com/gallery/2026-09-09weekly0.5https://trustboundarystudio.com/about/2026-09-09monthly0.4https://trustboundarystudio.com/posts/capital-one-2019/2026-09-09monthly0.8https://trustboundarystudio.com/og/capital-one-2019.pngThe Capital One breach was not an SSRF storyhttps://trustboundarystudio.com/thumbnails/capital-one-2019.pngCapital One, 2019: The Capital One breach was not an SSRF storyhttps://trustboundarystudio.com/thumbnails/capital-one-2019.pngThe Capital One breach was not an SSRF storyEveryone remembers the server-side request forgery. The regulator's findings never mention it. What the OCC actually penalised was risk assessment and internal audit.https://www.youtube-nocookie.com/embed/V4Z24ROPXfs4992026-09-09T00:00:00.000ZyesnoCapital OneSSRFIMDSv2AWS IAMleast privilegeOCC consent ordercloud misconfiguration