Blog

Thoughts on development, design, and everything in between.

Allapi-keysreview-widgethardeningcost-abusewoocommercestore-apiwordpresssupply-chainpluginnonceattack-surfacehybrid-stacknextjslegacy-modernincident-responseransomwaredetectionresilienceapi-documentationfastapidefault-configurationtlstransport-securityversion-hygienedowngradewafnegative-findingscorsaccess-controlpublic-datasingle-findingcontent-managementreconlow-severitytelemetryinformation-disclosureobservabilitydrupalend-of-lifesubdomainsserverlesscdnstatic-siteedge-functionsrest-apiauthorisationpatch-managementerror-handlingbookingcronfile-uploadrlsauthorizationmulti-tenantremediation-prioritymail-authenticationheadersspaangularbundle-analysisdefense-in-depthstatic-hostinguser-enumerationcredential-stuffingsecurity-headersclickjackingcsplegacy-cms
8/8/2026

A Patched Estate With Six Findings And No Exploits: Reporting Discipline

A restaurant site behind a web application firewall. Every plugin was current, every known exploit failed, and the report still had six findings worth acting on.

wordpresswafhardeningnegative-findings
5/16/2026

Eight Attack Vectors, Zero Findings: What A Hardened Single Page Application Looks Like

A negative assessment is a result. This one documents why eight standard vectors failed against a statically served application behind an edge platform.

spadefense-in-depthstatic-hostingnegative-findings