Engineering notes from the trenches.
Reverse-engineering APIs, automation that survives production, security research, and honest takes on the tools I ship with.
Filtered by tag:#security×
Sort
7 posts ← reset filters
SecurityPlaywright's API Testing Isn't Just a Postman Replacement — It's a Security Swiss Army Knife
Playwright's request context goes far beyond replacing Postman — it's a programmable, scalable tool for API security testing, auth token replay, schema validation, and multi-step attack simulation. Here's how a pentester uses it.
Jun 19, 2026 · 11 min- Security
phpMyFAQ's Password Reset Is Broken By Design: No Token, No Problem
A critical vulnerability in phpMyFAQ allows unauthenticated password resets by simply knowing a username and email, leading to full account takeover without any token validation.
May 20, 2026 · 6 min - Security
PenPot's RCE Blunder: The Dangerous Default of 0.0.0.0 and Unauthenticated Execution
A critical RCE vulnerability in PenPot's MCP module exposed instances to trivial code execution due to binding to all interfaces and an unauthenticated /execute endpoint. Learn what happened, why it matters, and how to secure your systems.
May 20, 2026 · 6 min - API RE
5 things I check before trusting an API
Before I integrate with any API — official or reverse-engineered — I run through this checklist to avoid surprises later.
May 18, 2026 · 8 min - API RE
What your JWT tokens reveal about your backend
JWTs are meant to be opaque to users. They're not. Here's what I learn about your architecture just by decoding one.
May 18, 2026 · 8 min - Security
Common auth mistakes I find when reverse-engineering APIs
After years of poking at APIs that weren't meant to be poked at, these are the auth patterns that break most often — and why.
May 18, 2026 · 9 min - Security
How I analyze API security headers in 30 seconds
A quick checklist for reading HTTP response headers and spotting security misconfigurations before you even look at the response body.
May 18, 2026 · 7 min