Tooling
openssl s_client Answers Every TLS Question
Chain broken, SNI wrong, protocol refused, certificate expiring. The TLS questions that produce guesswork are all answerable from one command, and the…
Deep Dive
TLS Session Resumption, and the Handshake That Never Got Faster
Resumption was enabled everywhere and the repeat handshakes were still full handshakes. Session tickets need a shared key across every backend, and behind a…
Security
Deleting the Commit Did Not Delete the Secret
The credential was removed from the current tree and the team considered it handled. The blob still lives in history, in every clone and in every fork, and…
Bug Hunt
One Cache Key, Two Customers, and a Very Bad Morning
Two accounts selling the same product slug saw each other's cached pricing. The key was built from the thing that was shared, and the thing that differed…
Security
SQL Injection Inside the ORM You Trusted
The codebase was fully parameterised except one helper that interpolated a column name into an orderBy. That single string was the injection, and the ORM…
Security
The Rate Limit That Counted IPs and Not Accounts
The login rate limit was working perfectly and the credential stuffing succeeded completely. A per IP limiter is a defence against a single attacker, and a…
Security
The Login Redirect Parameter That Sent Users Anywhere
A next parameter that accepts any URL turns your trusted domain into the first hop of a phishing link. The user sees your hostname, trusts it, and lands…
Security
The Webhook URL Field That Could Reach Your Metadata Endpoint
Any feature that fetches a URL the user supplies is a potential proxy into your internal network. The webhook settings page let an attacker reach the cloud…
Security
The JWT Library That Accepted alg none for Four Months
We pinned the signing algorithm on the way out and trusted the library on the way in. Algorithm confusion let a forged token verify successfully, and…
Bug Hunt
Logged In Users Saw Somebody Else's Search Results
A support ticket said search was returning the wrong products. It was returning the right products for somebody else.
Security
JWT Expired: When the Token Is Fine and the Clock Is Not
Tokens rejected as expired seconds after issue, or accepted long after they should have died. Both are the same bug seen from opposite ends.
MicroVMs
I Let an Agent Run rm -rf and Nothing Bad Happened
The question is not whether an autonomous agent will do something destructive. It is what the destruction can reach when it does.