Blog
Writing
Web security, tooling, and the occasional post about building the things I then have to secure.
4 entries
Understand the application before you test it
Scanners find what they were told to look for. The bugs that matter live in the gap between what an application believes about itself and what it actually enforces.
- Web Security
- OWASP
- Methodology
IDOR is still everywhere, and here is why
Broken object level authorisation stays the most common serious finding in web applications. Not because it is hard to fix, but because of where the check has to live.
- Web Security
- OWASP
- Bug Bounty
- Access Control
The JWT mistakes that still work in 2026
Algorithm confusion, unverified signatures and secrets that were never secret. A tour of the JWT failures I keep finding in labs, and what each one actually requires to exploit.
- Web Security
- JWT
- Authentication
- OWASP
Building a CTF platform taught me more security than solving CTFs
Running code that is designed to be attacked forces a kind of threat modelling that solving challenges never does. Notes from building Hackuten.
- Web Security
- Research
- Docker
- Linux