Blog
Thoughts on development, design, and everything in between.
- ModernAmusement Development
- Shady Nathan Tawfik
- Full-Stack · Data Science · ML/AI · Cybersecurity · Design · Open Source
The Door Beside the Front Door
An SSO gateway, a clean consent banner, a current LMS — and a mail backend answering anonymous requests beside it, a mailing-list host from 2010 and appliances sitting in 9.8-range advisories. 48 units, four waves, 445 findings: what a fleet finds when the front door is not the attack surface.
One Page Load, 42.8 MB of Data — and Twelve Security Headers That Were Never Sent
A static SPA with 76,000 pre-rendered pages pulled 42.8 MB of raw data into the browser on every detail view. In parallel, the deployment config's header rules turned out to be inert. A field report on two bugs with the same root cause: convenience in routing.
Security That Assumes the Attacker Uses the Front Door
A current, well-maintained WordPress site with a CDN and a managed web application firewall in front. No exploitable CVE, nothing to 'hack'. It was still undefended on three counts — because every control assumed the visitor would behave: the origin was reachable directly, no consent gate existed at all, and forged mail in the brand's name was delivered.
The Fleet That Proved Itself Wrong
55 agent units, one shared map, and a bug-bounty run that ended by disproving its own best leads. A build log of the orchestration, the evidence discipline, and why a negative result is still a result.
How I Built Bewertiq: Reading 10 Million Google Reviews as a Market Signal
A build log of five scraper generations, a SQLite-to-static-site pipeline, and the statistics that turn star ratings and deletion notices into a decision system.
What Instagram Sees When You Automate It
A build log of a small Instagram automation stack — the worker, the queue, the pacing engine and the caps — and the detection research that shaped every guardrail.
The Banner That Left the Screen: A Mobile Layout Postmortem
A privacy banner looked perfect on desktop and passed review. At 375px its primary call-to-action sat at x=452 in a 375px viewport — off-screen and untappable. The title refused to shrink, the value column collapsed to zero, and a global overflow guard hid the evidence. This is how a three-column grid fixed it.
Tracked Without Asking: How the Web Identifies You After Cookies
Third-party cookies are going away, and tracking did not. Fingerprints are recomputed on every load, the TLS handshake is an identifier before any script runs, client hints re-expose a frozen user agent, and state hides in caches and first-party subdomains. A fresh-profile lab run shows a visitor leaving zero cookies and still being unique — and what actually helps.
Perfect Consent, One Patch Behind: The Law Firm With the Cleanest Privacy Layer I Have Measured
A German law firm's website had the cleanest consent architecture I have measured — zero cookies and zero third-party requests before opt-in. It was also one patch behind a public unauthenticated XSS fix, shipped zero security headers on every page except the login, leaked tokens anonymously from its REST API, and left its mail trust chain half-built. Privacy maturity and security maturity are owned by different people.
The Consent Gate That Was Never Attached: A Platform-Wide Tracking Bypass
A four-domain municipal Drupal multisite showed a flawless consent setup on content pages — and none at all on the routes where consent matters most. The banner was not broken: the consent library was never attached to system and legal routes, so analytics and a Meta pixel executed before opt-in on every domain.
Consent Mode Is Not a Consent Gate
A digital agency's website had an up-to-date consent platform, a banner that rendered correctly and Google Consent Mode enabled — and still fired analytics, ads, Meta and LinkedIn before any opt-in, wrote cookies without consent and without Secure, and left its session cookie unprotected. Why signalling is not blocking, and how the fix was measured instead of argued about.
What Your Browser Shares About You (Without Asking): A Live Demo in the Nav
Every visit transmits an IP address, HTTP headers and dozens of device properties — and their combination re-identifies you with over 90% accuracy, no cookies required. I built a privacy banner for this site that shows every visitor, live, exactly what their browser just revealed: computed locally, stored nowhere, and with the reasons I refuse to fingerprint anyone.
The Second Pass: Three Blind Spots a Hardened WordPress Audit Missed
The first pass called the site hardened and rated it HIGH. A deeper second pass found an actively exploited WordPress core RCE, a credential-bound CORS reflection on the REST API and three installed-but-invisible plugins — and moved the rating to CRITICAL.
A Paid API Key Sat In The Page, And It Worked
A law firm site with a review widget that rendered a billable geocoding key into the HTML. The finding is narrow, trivially automatable, and the most profitable line item in the report.
Your Online Shop Exposes A Public API You Did Not Write
A lifestyle and commerce site on a current content platform with a store attached. Seventeen findings, and the store interface was the one nobody audited because it looked like a feature.
A Nonce In The Page Is Not A Secret, And The Plugin Knew It
A business innovation network ran a patched content platform with fourteen findings. The interesting one was a feature left switched on that published its own request tokens in the page source.
Modern Front End, Ancient Back Office: Auditing A Hybrid Estate
A petition platform ran a modern framework on the main domain and a legacy content system behind a raw server with no firewall. The modern side was excellent. The legacy side defined the risk.
What A Ransomware Incident Teaches About The Week Before It Started
A public-sector network was exfiltrated for roughly a week before anyone noticed. This write-up is about the controls that would have shortened that dwell time, not about the attacker.
The API Documentation Was Public, And It Was The Best Map You Can Ask For
An application built with an automated framework served interactive documentation and a machine-readable schema at a well-known path. Both were enabled by default and neither was behind a login.
If TLS Enforcement Is Optional, Version Downgrades Become Boring
A university content platform served mixed protocol versions on some hosts. No cipher was weak, no certificate was expired, and the transport layer still failed the assessment.
A Patched Estate With Six Findings And No Exploits: Reporting Discipline
A restaurant site behind a web application firewall. Every plugin was current, every known exploit failed, and the report still had six findings worth acting on.
One Finding, Maximum Impact: A Permissive Cross-Origin Policy
A civic content platform on a modern stack produced a single finding of the highest severity. It needed no version check and no exploit; the browser already did the work.
A Platform For Internal Communication, Exposed To The Internet
A public-facing cooperation and counselling platform ran a content system with three low-severity findings. The lesson was in what a low-severity result does not tell you.
Error Tracking Telemetry Describes Your Architecture To Anyone With A Browser
A platform provider running a Java backend behind two reverse proxies with a modern front end. The interesting finding was not a vulnerability but an inventory: error tracking revealed the internal structure.
The Legacy Instance Beside The Modern One Is The Real Estate
One organisation ran two generations of a content platform simultaneously. The modern one was current; the legacy one defined the risk, including a client library past end of life.
Static Site, Serverless Functions, Twelve Findings
A site builder platform with a content delivery network in front and functions behind it. The static layer was clean; the function layer and the mail configuration were not.
A Plugin Can Be Current And Still Hand Out Records To Anyone
A fully patched content management system carried a plugin with current releases and twelve findings. The pattern was authorisation: routes that answered before the permission callback ran.
Error Pages Are An Unintentional API Documentation Endpoint
Across a mixed estate the same three leaks appeared again and again: stack traces, framework banners and absolute filesystem paths. Each one maps the internals for free.
The Booking Plugin Is The Product, And The Product Is An Admin Surface
A training provider with a booking plugin exposed to the internet exposed its entire administrative surface with it: exports, attendee records, file uploads and an unauthenticated cron.
A Row Level Security Policy Is A Boundary You Have To Test From The Client Side
A platform-generated application stored every tenant table behind row level security. The policy was correct on paper and bypassable in practice, because the client held a key the policy trusted too much.
Twenty Findings, One Platform: How Volume Changes The Remediation Order
An industrial supplier with a large content surface produced twenty findings across seven categories. The value was in the ordering, not the count.
A Single Page Application Hands You Its Own Route Map
A modern framework application with almost no server-side exposure still revealed its administrative surface, because the route table is compiled into the client bundle.
Eight Attack Vectors, Zero Findings: What A Hardened Single Page Application Looks Like
A negative assessment is a result. This one documents why eight standard vectors failed against a statically served application behind an edge platform.
WordPress User Enumeration Is Not The Finding, It Is The Multiplier
A tax advisory firm exposed every account slug through its public REST API, shipped no security headers at all, and left the login form without rate limiting.
A Legacy Municipal CMS With Perfect Transport Security And No Clickjacking Protection
HSTS was immaculate on a German municipal court portal. One missing header still allowed framing, and the CSP permitted script injection outright.