Field notes.
Write-ups from both sides of the keyboard: how real systems break in security assessments, and how I build them so they don't.
Your CI runner is a production server
pull_request_target, script injection and mutable tags — why GitHub Actions is one of the most under-tested attack surfaces in a modern codebase, and the hardening checklist I apply to every repo.
SSRF to cloud keys, and why IMDSv2 exists
How a single "fetch this URL" feature turns into stolen IAM credentials, what IMDSv2 actually changes at the HTTP level, and the layered defences I recommend after every cloud-hosted VAPT.
Anatomy of an OAuth account takeover
Missing state, loose redirect URIs and unverified email linking — the OAuth and "Sign in with…" mistakes that keep turning into account takeover, mapped against RFC 9700.
Five JWT mistakes I keep finding in VAPT
alg confusion, decode-instead-of-verify, kid injection, missing claim checks and crackable secrets — how each JWT flaw is exploited, and the few lines of code that prevent it.
BOLA — the bug scanners can't find
Broken Object Level Authorization tops the OWASP API Security Top 10 because it's a business-logic bug. How I hunt it with two accounts and a proxy, and how I design APIs so it can't happen.
CVE-2025-55184 — pre-auth DoS in React Server Components
How a single unauthenticated request could hang a Next.js App Router server through unsafe deserialization in the RSC Flight protocol, which versions are affected, why the first patch was incomplete (CVE-2025-67779), and what to do about it.
Idempotency is a security property
Limit-overrun races, the single-packet attack and why "check then act" is a vulnerability. A developer's guide to idempotency keys, atomic updates and database constraints — written by someone who also exploits them.