Engineering · Security · DevSecOps

Engineering & Security

Building software and breaking it: product security, DevSecOps, and real-world vulnerabilities.

  • Penetration testing · web, API & mobile
  • Product security & DevSecOps
  • Secure code review

Security Research

Real vulnerabilities and how they were found.

Product Security & DevSecOps

Security built into delivery.

Engineering

Where backend assumptions break.

Latest articles

LatestEngineeringSecuritySep 14, 2026 · 2 min read

Fuzz the type, not just the value

Change a parameter's type, not just its value, to find authorization bugs.

  • bug bounty
  • appsec
  • tips
Read article

SecurityDec 20, 2024 · 6 min read

From Comments to Command Execution: How an E-Book Platform Gave Me RCE

From stored XSS in comments to file upload to remote code execution.

  • rce
  • xss
  • file upload
Read article

SecurityDec 5, 2024 · 3 min read

From Frustration to Exploitation: How a Link Shortener Helped Me Bypass WAF

Getting past a WAF through the site's own link shortener.

  • waf bypass
  • xss
  • bug bounty
Read article