Writing
Blog
Notes on what I build and break: frontend engineering, performance, accessibility, and the security side of the craft. Posts live here first and are syndicated elsewhere.
10 min read
What my WAF actually blocked, and what my app already stops on its own
I ran 26 attack payloads against a production app with ModSecurity on and off. It blocked 12: five my app already rejected, and seven it stopped a step earlier than the app's own defences. The class behind most real breaches never showed up in either column.
- security
- webdev
- devops
- cybersecurity
7 min read
Ethical hacking is not a toolset, it is a mindset with a permission slip
Hacker, ethical hacker and penetration tester are not the same thing, and one of the differences is an invoice versus a criminal record. The mindset, the seven-stage method, and the black, grey and white box styles, laid out plainly.
- cybersecurity
- security
- appsec
- penetrationtesting