Writing & research
The Blog
Methodology, deep dives and post-mortems from the front line of web, mobile, API and Web3 security.
Breaking an AI Platform
Three findings in a self-hosted LLM platform, chained by information: a verbose error pinned the stack, the stack pinned a CVE, and the CVE led to a critical cross-user OAuth token leak through MCP.
Breaking a Payment API
Six business-logic bugs in a bill-payment API, found by treating the API as a state machine and breaking one promise at a time. Anonymised writeup.