Article3 min
Understand the application before you test it
Scanners find what they were told to look for. The bugs that matter live in the gap between what an application believes about itself and what it actually enforces.
- Web Security
- OWASP
- Methodology
Article4 min
IDOR is still everywhere, and here is why
Broken object level authorisation stays the most common serious finding in web applications. Not because it is hard to fix, but because of where the check has to live.
- Web Security
- OWASP
- Bug Bounty
Article2 min
The JWT mistakes that still work in 2026
Algorithm confusion, unverified signatures and secrets that were never secret. A tour of the JWT failures I keep finding in labs, and what each one actually requires to exploit.
- Web Security
- JWT
- Authentication