Practical security learning, defensive thinking, web security, privacy, and risk management without claiming final answers.
A password alone protects an account only as long as the password remains secret. Reused passwords leak in one breach and are tried elsewhere. Time-based one-time password (TOTP) adds "something you have" to "something you know": a code that changes every thi…
Read article
A small PHP application eventually needs a database password, an API token, or a key for signing messages. Where should that value live? Pu…
A settings form can require a valid login and still accept a request the user never meant to send. The session cookie tells the server whic…
A login form can verify the right password and still leave the account resting on a weak session. The difficult part begins after authentic…
A file upload form looks like a small feature: receive a file, move it into a directory, and save its name. The difficult question begins o…
The first SSH connection to a server often pauses before asking for a password or using a user key. It shows a fingerprint and asks whether…
A personal domain may send a password reset through a web host, a contact-form reply through a mailbox provider, and a newsletter through a…
If you've ever wanted to practice threat hunting, incident response, or security monitoring without risking your production network, a SOC …
Every time a ransomware story mentions a hospital or a bank, most of us shrug. "That is not my world," we tell ourselves. "My little server…
A shared folder rarely announces when it has become risky. One day it contains a lunch menu and meeting notes; a month later, someone drops…
