Skip to content

/ Security Writeups

Notes from the field.

Detailed write-ups on application security, API authorization, and what penetration test findings actually mean for the people who act on them.

SecurityAug 16, 2026·15 min read

Testing Writeup

Testing Writeup

TEST
Read writeup
API SecurityJun 2, 2026 · 8 min read

Why Broken Object-Level Authorization keeps beating scanners

BOLA is consistently the most common critical finding in modern APIs, and automated tools are structurally unable to catch it. Here's the manual approach that does.

Secure SDLCApr 18, 2026 · 6 min read

Threat modeling before sprint one, not after the pentest

Moving security review earlier changes what a penetration test finds — and what it costs to fix. A practical case for lightweight threat modeling in planning.

For LeadershipFeb 27, 2026 · 7 min read

How to read a penetration test report as a product leader

A findings list isn't a to-do list. A framework for triaging pentest output by business impact instead of CVSS score alone.

API SecurityDec 11, 2025 · 9 min read

GraphQL's flexibility is an authorization problem in disguise

Field-level resolvers make it easy to forget who's allowed to ask what. Common GraphQL authorization failures and how to test for them.