Blog
Thoughts on development, design, and everything in between.
9/26/2026
A Paid API Key Sat In The Page, And It Worked
A law firm site with a review widget that rendered a billable geocoding key into the HTML. The finding is narrow, trivially automatable, and the most profitable line item in the report.
api-keysreview-widgethardeningcost-abuse
8/8/2026A Patched Estate With Six Findings And No Exploits: Reporting Discipline
A restaurant site behind a web application firewall. Every plugin was current, every known exploit failed, and the report still had six findings worth acting on.
wordpresswafhardeningnegative-findings
7/25/2026A Platform For Internal Communication, Exposed To The Internet
A public-facing cooperation and counselling platform ran a content system with three low-severity findings. The lesson was in what a low-severity result does not tell you.
content-managementreconhardeninglow-severity
6/20/2026Error Pages Are An Unintentional API Documentation Endpoint
Across a mixed estate the same three leaks appeared again and again: stack traces, framework banners and absolute filesystem paths. Each one maps the internals for free.
information-disclosureerror-handlinghardeningrecon