Encrypting content is easy. Hiding who talks to whom is not.
Notes from designing Orbyte: why metadata is often more sensitive than message content, and the spectrum of defences between 'we encrypt messages' and actual metadata resistance.
- Research
- Web Security
- Cryptography
Understand the application before you test it
Scanners find what they were told to look for. The bugs that matter live in the gap between what an application believes about itself and what it actually enforces.
- Web Security
- OWASP
- Methodology
From a blind SQL injection to a shell, one bit at a time
Personal lab
A lab walkthrough: finding a boolean-blind injection with no visible output, turning it into data exfiltration, then into file write, then into code execution.
- Write-ups
- Web Security
- SQL Injection
IDOR is still everywhere, and here is why
Broken object level authorisation stays the most common serious finding in web applications. Not because it is hard to fix, but because of where the check has to live.
- Web Security
- OWASP
- Bug Bounty
The JWT that trusted its own header
Personal lab
A lab write-up on an authentication bypass through JWT algorithm confusion — the classic 'alg: none' and its slightly less obvious RS256-to-HS256 cousin.
- Write-ups
- Web Security
- Authentication
The JWT mistakes that still work in 2026
Algorithm confusion, unverified signatures and secrets that were never secret. A tour of the JWT failures I keep finding in labs, and what each one actually requires to exploit.
- Web Security
- JWT
- Authentication
Building a CTF platform taught me more security than solving CTFs
Running code that is designed to be attacked forces a kind of threat modelling that solving challenges never does. Notes from building Hackuten.
- Web Security
- Research
- Docker