Blog
Thoughts on development, design, and everything in between.
9/12/2026
A Nonce In The Page Is Not A Secret, And The Plugin Knew It
A business innovation network ran a patched content platform with fourteen findings. The interesting one was a feature left switched on that published its own request tokens in the page source.
wordpresspluginnonceattack-surface
8/22/2026The API Documentation Was Public, And It Was The Best Map You Can Ask For
An application built with an automated framework served interactive documentation and a machine-readable schema at a well-known path. Both were enabled by default and neither was behind a login.
api-documentationfastapiattack-surfacedefault-configuration
5/23/2026A Single Page Application Hands You Its Own Route Map
A modern framework application with almost no server-side exposure still revealed its administrative surface, because the route table is compiled into the client bundle.
spaangularbundle-analysisattack-surface