I work on security engineering. Everything I learn ends up here.
I have spent close to a decade on the offensive side: offensive AI development, web, internal network, mobile and API penetration testing, red team work and DevSecOps. Everything here is based on public vulnerability reports and experiments in my own lab — these are personal notes. Enjoy the read.
Writing
161 posts · page 14 / 14Did You Actually Code It or Just Vibe It? The Dark Side of AI-Generated Apps
AI makes coding feel like magic, but that "vibe" can be dangerous. Let's talk about why trusting LLMs too much might break your security.
Hunting Digital Footprints: Why Google is Just the Tip of the Iceberg
Forget basic dorking. Let’s talk about how to find the hidden gaps in a company’s attack surface using subdomains and GitHub leaks.
That 3 AM Phone Call: The Side of Incident Response You Won't Find in Textbooks
Incident response isn't just about technical steps; it's about managing chaos. Here's what really happens when the SOC calls you at midnight.
Moving Fast vs. Playing it Safe: The Dirty Laundry of DevSecOps
Is your speed causing security nightmares? From leaked AWS keys to noisy SAST tools, here is the real deal on making DevSecOps actually work for you.
Hunting the Silence: Are You Just Waiting or Actually Looking?
Everything looks green on your dashboard, but is it really? Learn why waiting for alarms is a trap and how to start hunting threats instead.