What I Write About Here

This space is for practical notes on the gap between what looks secure and what is actually secure in modern web applications.

Topics will mostly include:

• web application security
• API risk
• browser-side vulnerabilities
• practical penetration testing
• AI-assisted security workflows

A lot of security issues do not fail because teams ignore them completely. They fail in the gap between assumptions and reality:

• “the scan came back clean”
• “the framework should handle that”
• “this path is internal only”
• “this issue is low severity in practice”

The focus here will be on practical write-ups, real attack paths, remediation lessons, and the kinds of security problems that affect actual product and business workflows.