Blog
Notes on APIs, automation, and security.
Technical posts on reverse-engineering, security research, automation patterns, and the day-to-day of solo engineering work.
Blog
Technical posts on reverse-engineering, security research, automation patterns, and the day-to-day of solo engineering work.
A missing input validation on M-Tix Cinema XXI's food ordering API let me increase my account balance by submitting negative quantities. No tools needed — just a browser.
CloakBrowser claims to be a stealth Chromium that passes every bot detection test. I installed it, ran it against reCAPTCHA v3, Cloudflare Turnstile, and FingerprintJS to see if the hype is real.
Mole is a single CLI binary that replaces CleanMyMac, AppCleaner, DaisyDisk, and iStat Menus. I tested it on my 256GB MacBook — here's what it found.
A quick checklist for reading HTTP response headers and spotting security misconfigurations before you even look at the response body.
After years of poking at APIs that weren't meant to be poked at, these are the auth patterns that break most often — and why.
JWTs are meant to be opaque to users. They're not. Here's what I learn about your architecture just by decoding one.
Before I integrate with any API — official or reverse-engineered — I run through this checklist to avoid surprises later.
How I built custom tooling to manage hundreds of wallets, automate on-chain transactions, and run social bots across multiple protocols.
A practical walkthrough of the methodology I use when there's no documentation: capturing traffic, mapping endpoints, and validating assumptions before writing a single line of automation.
DevTools shows you everything, which is the problem. Here's how I filter signal from noise when reverse-engineering a web application's API.