Sample Lab: Checking Record Ownership
An editable local exercise for checking that an API enforces ownership on every record request.
Latest write-ups
All write-ups →Sample Lab: Following an Untrusted Redirect
Editable practice write-up about tracing a redirect in a deliberately local demo app.
Sample Note: Reviewing a CORS Policy
A practical checklist for documenting cross-origin response rules on an application you own.
Sample Note: A First Pass at Security Headers
Editable starter note for recording a defensive review of headers on a site you own.
Sample Lab: Reviewing Session Cookies
An editable checklist for checking browser session-cookie settings and lifecycle behavior.
JWT key confusion in a small API
How an algorithm mismatch turned a harmless token check into account access.
A little about this space
More about me →A collection of technical write-ups, lab notes, and things learned while exploring security. Written to make the next investigation a little easier.