Practical security learning, defensive thinking, web security, privacy, and risk management without claiming final answers.
A settings form can require a valid login and still accept a request the user never meant to send. The session cookie tells the server which browser session is making the request, but it does not necessarily tell the server which page caused that browser to s…
Read article
A login form can verify the right password and still leave the account resting on a weak session. The difficult part begins after authentic…
A file upload form looks like a small feature: receive a file, move it into a directory, and save its name. The difficult question begins o…
The first SSH connection to a server often pauses before asking for a password or using a user key. It shows a fingerprint and asks whether…
A personal domain may send a password reset through a web host, a contact-form reply through a mailbox provider, and a newsletter through a…
If you've ever wanted to practice threat hunting, incident response, or security monitoring without risking your production network, a SOC …
Every time a ransomware story mentions a hospital or a bank, most of us shrug. "That is not my world," we tell ourselves. "My little server…
A shared folder rarely announces when it has become risky. One day it contains a lunch menu and meeting notes; a month later, someone drops…
A home server can look perfectly healthy while an important file has quietly changed. A modified SSH configuration, an unexpected binary, o…
security.txt for a Personal Website — Give Security Reports a Clear Front Door A personal website may be small, but it still has doors, win…
