Blog

Thoughts on development, design, and everything in between.

Allapi-keysreview-widgethardeningcost-abusewoocommercestore-apiwordpresssupply-chainpluginnonceattack-surfacehybrid-stacknextjslegacy-modernincident-responseransomwaredetectionresilienceapi-documentationfastapidefault-configurationtlstransport-securityversion-hygienedowngradewafnegative-findingscorsaccess-controlpublic-datasingle-findingcontent-managementreconlow-severitytelemetryinformation-disclosureobservabilitydrupalend-of-lifesubdomainsserverlesscdnstatic-siteedge-functionsrest-apiauthorisationpatch-managementerror-handlingbookingcronfile-uploadrlsauthorizationmulti-tenantremediation-prioritymail-authenticationheadersspaangularbundle-analysisdefense-in-depthstatic-hostinguser-enumerationcredential-stuffingsecurity-headersclickjackingcsplegacy-cms
7/25/2026

A Platform For Internal Communication, Exposed To The Internet

A public-facing cooperation and counselling platform ran a content system with three low-severity findings. The lesson was in what a low-severity result does not tell you.

content-managementreconhardeninglow-severity
6/20/2026

Error Pages Are An Unintentional API Documentation Endpoint

Across a mixed estate the same three leaks appeared again and again: stack traces, framework banners and absolute filesystem paths. Each one maps the internals for free.

information-disclosureerror-handlinghardeningrecon