Deep dives, guides, and strategic commentary on software engineering leadership, security compliance, scaling databases, and building production-grade LLM workflows.
Business logic vulnerabilities are the most financially damaging class of web security flaw — and completely invisible to automated scanning. Here's what they are, real examples, and how to test for them.
A 19-year-old used compromised credentials to log into PowerSchool's support portal — no MFA, no additional verification — and walked out with data on 62 million students and teachers. Your internal tools are almost certainly your softest target. Here's what to do about it.
Not all penetration tests are created equal. Some are scanner reports with a human signature. Here's exactly what to ask before you pay — the red flags that reveal automation masquerading as manual testing, and the green flags that show genuine expertise.
Automated testing and manual pen testing are not competitors. Here's exactly which to use for what, when to do each, and how startups build the right security testing stack without overspending.
Three medium and low severity findings. One complete account takeover. Here's how vulnerability chaining works — and why your automated scan report's severity ratings are misleading you.
The Samsung Germany breach used 4-year-old credentials that were never rotated. The Change Healthcare breach exploited a missing MFA control. Neither would show up on a vulnerability scanner. Here's what clean reports miss.
On March 31, 2026, two malicious versions of Axios — the most widely used HTTP client in JavaScript with 83 million weekly downloads — were briefly published to npm via a compromised maintainer account. They contained a cross-platform remote access trojan. Here's exactly what happened and what you need to do.
Every pen tester uses Nessus, Burp Suite, Nmap, OWASP ZAP, and Metasploit. Here is an honest breakdown of what each tool actually does — and the specific limits that make manual testing irreplaceable.
Automated vulnerability scanners are essential — but they find roughly 20-30% of real security vulnerabilities. Here's exactly what they miss and why it matters for your business.
A complete, jargon-free guide to web application penetration testing — what it is, how it works, what gets tested, what a report looks like, and how to get started. Written by a developer turned pen tester.
Before any serious testing begins, there's a 10-minute checklist I run on every web application I assess. Here's exactly what it includes — and how you can use it to check your own app right now.
On March 24, 2026, two malicious versions of the LiteLLM Python package were published to PyPI. They were live for less than three hours. LiteLLM has 3 million daily downloads and sits inside 36% of cloud environments. Here's exactly what happened and what you need to do right now.
In 2024, a developer spent two years contributing legitimate code to a critical open-source library — then inserted a backdoor that could have given any attacker remote access to millions of Linux servers worldwide. It was caught by one engineer who noticed SSH logins were 500 milliseconds slower than normal.
Security Misconfiguration jumped from #5 to #2 on OWASP 2025. Here's why — with real breach examples, the most common mistakes found during real assessments, and how to fix them before an attacker finds them first.
In 2022, nearly 10 million Optus customers had their data stolen by changing a single number in an API request. Here's exactly how it worked — and how to make sure it can't happen to you.
OWASP just updated its Top 10 Web Application Security Risks for the first time in four years — analysing 2.8 million applications and 175,000 CVE records. Two new categories. Major reshuffling. Here's exactly what changed and what every developer and CTO needs to know.
A practical, jargon-free guide to building a social engineering defence for any team — without a large security budget. Five things you can implement this week.
Social engineering doesn't target intelligence — it targets psychology. Here are the 6 psychological triggers every attacker exploits, grounded in peer-reviewed research, and how understanding them is your most effective defence.
Over 80% of phishing emails now use AI-assisted content. Here's what actually changed, what AI phishing looks like up close, and the only defence framework that still works in 2026.
MFA is essential but not sufficient. Here's how attackers bypass MFA through social engineering — with real case studies — and what additional controls actually work.
