Web Security
How I approach testing an authentication flow
A practical checklist for understanding sessions, tokens, access controls and edge cases.
Read article →
Latest deep dive · 8 min read
Understanding OAuth: from authorization code to account takeover
A practical, beginner-friendly look at OAuth flows, redirects, tokens, common implementation mistakes and how to reason about them during a security assessment.
Read the story →$ curl -i https://target.example
HTTP/2 200 OK
server: nginx
content-type: text/html
$ inspect → understand → test
✓ Think like an attacker.
✓ Document like a defender.
$