JWT key confusion in a small API
How an algorithm mismatch turned a harmless token check into account access.
Latest write-ups
All write-ups →Cache me if you can
A cache key that forgot the Host header made the response reusable in the wrong place.
Notes on Linux capabilities
A field checklist for understanding what a process can do beyond its UID.
A little about this space
More about me →A collection of technical write-ups, lab notes, and things learned while exploring security. Written to make the next investigation a little easier.