A CVSS 10.0 unauthenticated RCE in React Server Components, what caused it, and where the same class of bug is sitting in your own stack.
A high-severity webhook SSRF, the general pattern behind it, and the one control that survives the next coding mistake.