Web security · 4 min read
Broken access control: the bug class that outlives every framework
Frameworks solved authentication a decade ago. Authorisation is still hand-written per endpoint, which is why the same finding leads report after report.
Blog
Writing from the work
About this blog
This blog covers application security as it turns up in real assessments: mobile app hardening, API authorisation, web access control, cloud blast radius, secure coding practice and the compliance questions Indian product teams get asked. 18 posts, each dated and revised when the advice changes.
API security · 4 min read
JWTs are not sessions: token handling mistakes in mobile backends
A JWT is a signed claim, not a session. Treating it as one produces tokens nobody can revoke and a logout button that logs nobody out.
Cloud security · 3 min read
The IAM blast radius review, step by step
A compliance score tells you which policies are untidy. A blast radius review tells you what happens when one CI key leaks — which is the question you actually need answered.
Compliance · 3 min read
How to answer an enterprise security questionnaire without lying
The instinct is to answer yes to everything and hope nobody checks. Reviewers check, and a caught overclaim costs more than every honest no combined.
Secure coding · 3 min read
Secrets in git history: finding them before someone else does
Deleting a key in a later commit does not remove it. The only response that counts is rotation, and the only prevention that works runs before the commit lands.
Cloud security · 3 min read
The logs you will wish you had after an incident
During an incident you cannot add logging retroactively. Every question you will be asked depends on events you either recorded beforehand or did not.
Want this run against your own product?
Scope and a fixed quote within two working days. First consultation is free.