Writeups

Notes from breaking & fixing

Vulnerability research, exploit walkthroughs, retired-box reports, and AppSec patterns I learn the hard way so you don't have to.

• AppSec · Jul 07, 2026 · hard

  Building authzscan: Agent-Driven IDOR Detection You Can Actually Measure

  Why pattern-matching SAST misses broken access control, how a four-phase Claude agent pipeline finds it, and the seeded benchmark that keeps the whole thing honest.

  • idor
  • bola
  • agents
  • llm
  • nextjs
  • sast
  • eval
  • appsec
• Research · May 04, 2026

  Ghost AI: Architecture-First Engineering in the Age of AI Agents

  A real-time collaborative workspace where you design systems instead of typing them — and the context-managed workflow that built it. Notes on what senior engineering looks like when implementation becomes a commodity.

  • ai
  • architecture
  • next.js
  • prisma
  • postgres
  • typescript
  • tailwind
  • liveblocks
  • react-flow
• AppSec · Apr 28, 2026 · medium

  Building jwt-scan: A CLI That Hunts the Five JWT Bugs From My Lab

  Turning a vulnerability lab into a shippable scanner. From research artifact to npm package, with token-only and live-endpoint modes, in one weekend.

  • jwt
  • cli
  • tooling
  • appsec
  • node
  • typescript
• AppSec · Apr 15, 2026 · easy

  JWT alg=none Bypass: When the Token Trusts Itself

  How a one-line algorithm header turns authentication into security theater, and why allowlisting is the only fix.

  • jwt
  • auth
  • owasp
  • appsec