---
id: 5528
title: "When security features collide"
source_domain: portswigger.net
source_url: "https://portswigger.net/research/when-security-features-collide"
published_at: "2023-10-02T14:37:00Z"
tags: ["web-security", "xss", "defense", "cloudflare", "portswigger", "waf-bypass", "security-features"]
phying_url: "https://phying.com/item/5528"
lang: en
---

# When security features collide

## Summary

James Kettle argues stacked security features can make systems easier to exploit, demonstrating a Cloudflare email obfuscation quirk that bypasses its WAF and all browser XSS filters.

## Intelligence Metadata

- **Sources:** portswigger.net
- **Published:** 2023-10-02T14:37:00Z
- **Original:** https://portswigger.net/research/when-security-features-collide
- **Phying News:** https://phying.com/item/5528