Blog
Notes on APIs, automation, and security.
Technical posts on reverse-engineering, security research, automation patterns, and the day-to-day of solo engineering work.
Blog
Technical posts on reverse-engineering, security research, automation patterns, and the day-to-day of solo engineering work.
A missing input validation on M-Tix Cinema XXI's food ordering API let me increase my account balance by submitting negative quantities. No tools needed — just a browser.
A quick checklist for reading HTTP response headers and spotting security misconfigurations before you even look at the response body.
After years of poking at APIs that weren't meant to be poked at, these are the auth patterns that break most often — and why.