I bypassed AWS API Gateway auth with a trailing slash. Got $12K bounty

A security researcher discovered a $12,000 bug bounty vulnerability in a fintech company's AWS API Gateway where adding a trailing slash to authenticated endpoints (e.g., `/v1/accounts/` instead of `/v1/accounts`) bypassed JWT authorization checks. The HTTP API's greedy path matching caused the authorizer to validate the original request but then drop authentication context during path rewriting to the backend integration, allowing unauthorized access to account data and the ability to initiate wire transfers. The company fixed the issue by switching to stricter REST API path matching and adding validation checks in every Lambda function.