Blog

Thoughts on development, design, and everything in between.

Allapi-keysreview-widgethardeningcost-abusewoocommercestore-apiwordpresssupply-chainpluginnonceattack-surfacehybrid-stacknextjslegacy-modernincident-responseransomwaredetectionresilienceapi-documentationfastapidefault-configurationtlstransport-securityversion-hygienedowngradewafnegative-findingscorsaccess-controlpublic-datasingle-findingcontent-managementreconlow-severitytelemetryinformation-disclosureobservabilitydrupalend-of-lifesubdomainsserverlesscdnstatic-siteedge-functionsrest-apiauthorisationpatch-managementerror-handlingbookingcronfile-uploadrlsauthorizationmulti-tenantremediation-prioritymail-authenticationheadersspaangularbundle-analysisdefense-in-depthstatic-hostinguser-enumerationcredential-stuffingsecurity-headersclickjackingcsplegacy-cms
8/15/2026

If TLS Enforcement Is Optional, Version Downgrades Become Boring

A university content platform served mixed protocol versions on some hosts. No cipher was weak, no certificate was expired, and the transport layer still failed the assessment.

tlstransport-securityversion-hygienedowngrade
7/11/2026

The Legacy Instance Beside The Modern One Is The Real Estate

One organisation ran two generations of a content platform simultaneously. The modern one was current; the legacy one defined the risk, including a client library past end of life.

drupalend-of-lifeversion-hygienesubdomains