Building a website taught me how to make things work. Trying to break it taught me what I had been missing all along.

I wanted to see whether an AI coding assistant could take some of the repetitive work out of bug bounty reconnaissance. The interesting…

Subtitle: A simple web app that searches HackerOne, Bugcrowd, Intigriti and YesWeHack by in-scope asset, all in one place.

Generate edge-case API integration tests with GenAI for stronger coverage and reliability

AI can build a working web app surprisingly fast. The interesting part begins when you stop asking whether the code works and start asking…

I thought I understood how websites worked until I stopped looking at the page and started looking at the requests behind it.

After testing security tools, I realized that a few small Python scripts could automate the repetitive work I kept doing by hand.

Web Exploitation · 2 solves

PHP, GitLab, LiteLLM and a broken certificate authority, all in one week. Here’s what happened and exactly what to do.

A compromised LiteLLM release stole provider keys this week, and a new tool called Alter Vault argues agents should never see credentials…

I used to think web security was mostly about learning the right tools. Building an intentionally vulnerable application taught me…

A security incident involving eMudhra intermediate certificates has forced the removal of the emSign CA certificate from popular trust bundles such as certifi. In response, the Python team pushed …

Manage SSH tunnels, network discovery, and pivoting across a penetration-testing engagement — from a standalone CLI, an msfconsole-style…