Security Blog
Technical writeups on web security, vulnerability research, and lessons from the field.
LLM Prompt Injection — Real-World Examples in 2026
Your AI integration can leak system prompts, expose training data, or execute unauthorized commands. Here's what I find in real engagements.
How I Found a Critical Auth Bypass in 2 Hours
A real-world case study of how a single missing middleware check gave access to every admin function. Without source code.
Top 5 OWASP API Security Risks in 2026
APIs are the attack surface of modern SaaS. These are the 5 vulnerability categories I see in every other engagement.
Why Your SaaS Needs a Pentest Before Series A
Founders underestimate how much a single security incident can kill their funding round. Here's why a pentest should be on your pre-funding checklist.