> _
Notes from the field on offensive security, secure architecture, and the AI-era threat landscape by a senior engineer who ships and breaks systems for a living.
Recent write-ups
Becoming a Cybersecurity Expert: Red Team / Blue Team Mastery Roadmap
A complete six-phase roadmap from software developer to professional-grade defender who can exploit, detect, hunt, harden, and run purple-team exercises.
Exploiting JWT Misconfigurations in Modern APIs
JSON Web Tokens promise stateless, tamper-proof authentication until a single misconfiguration hands an attacker the keys to every account.
Bypassing Content-Security-Policy in the Real World
A field guide to CSP gadgets, nonce reuse, and JSONP endpoints that quietly defeat your strongest header.
Hardening CI/CD Against Supply-Chain Attacks
A pragmatic checklist for pinning dependencies, isolating runners, and reducing the blast radius of a compromised pipeline.
Reverse-Engineering a Smart Router's Firmware
Dumping flash, unpacking SquashFS, and finding the hardcoded credential that started it all.
Implementing mTLS Across a Microservices Mesh
Identity-based service auth without the YAML sprawl: certificates, rotation, and graceful failure modes.