Blog

Thoughts on development, design, and everything in between.

Allapi-keysreview-widgethardeningcost-abusewoocommercestore-apiwordpresssupply-chainpluginnonceattack-surfacehybrid-stacknextjslegacy-modernincident-responseransomwaredetectionresilienceapi-documentationfastapidefault-configurationtlstransport-securityversion-hygienedowngradewafnegative-findingscorsaccess-controlpublic-datasingle-findingcontent-managementreconlow-severitytelemetryinformation-disclosureobservabilitydrupalend-of-lifesubdomainsserverlesscdnstatic-siteedge-functionsrest-apiauthorisationpatch-managementerror-handlingbookingcronfile-uploadrlsauthorizationmulti-tenantremediation-prioritymail-authenticationheadersspaangularbundle-analysisdefense-in-depthstatic-hostinguser-enumerationcredential-stuffingsecurity-headersclickjackingcsplegacy-cms
9/19/2026

Your Online Shop Exposes A Public API You Did Not Write

A lifestyle and commerce site on a current content platform with a store attached. Seventeen findings, and the store interface was the one nobody audited because it looked like a feature.

woocommercestore-apiwordpresssupply-chain
7/18/2026

Error Tracking Telemetry Describes Your Architecture To Anyone With A Browser

A platform provider running a Java backend behind two reverse proxies with a modern front end. The interesting finding was not a vulnerability but an inventory: error tracking revealed the internal structure.

telemetrysupply-chaininformation-disclosureobservability