./blog
Notes from building and breaking
Write-ups, post-mortems and the occasional opinion. No newsletter, no pop-up — the RSS feed is at the bottom.
The access-control bug you will ship next quarter
Broken access control has topped the OWASP list for years and it is still the finding I write up most often. Not because it is subtle, but because it lives in the gap between the developer who wrote the query and the product manager who described the role. Here is the review checklist I use, and the fuzzing harness that automates the tedious half of it.
Read the post →28 Jul 2026 · 6 min
Reading a Rust binary with no symbols
A slow walk through triaging a stripped release build, and where the compiler still leaves fingerprints.
14 Jun 2026 · 11 min
Least-privilege IAM without breaking every deploy
How to tighten an AWS account that grew organically, in an order that does not page your on-call at midnight.
02 May 2026 · 7 min
Why my first CLI tool nobody installed
A post-mortem on scope creep, and the rewrite that cut the feature list by five sixths.
19 Mar 2026 · 8 min
Subdomain takeover, two years after the fact
A dangling CNAME, an eleven-hour fix, and what the incident said about asset inventory.
07 Feb 2026 · 5 min
Typed APIs are a security control
Schema validation at the edge removes an entire class of injection bug before you write a single test.
21 Dec 2025 · 10 min
Running a CTF for people who have never played one
Notes from designing an internal capture-the-flag for a product team, including the challenges that flopped.