Writing
Writing on application security, cloud, IT and detection engineering
How attacks on web apps, cloud and the systems around them work, how to test for them, and how to prevent and detect them, with the tools I build along the way.
3 Oct 2026
Rolling out an AWS data perimeter
How to attach SCPs and RCPs without breaking production: an audit mode from CloudTrail, the order to roll out, break-glass access, the failures that recur, and how to prove the perimeter holds.
15 Sept 2026
WebSocket security
A long-lived, two-way connection changes the whole security question. Why HTTP instincts and tooling break on WebSockets, the bug classes that matter, and how I test them.
12 Sept 2026
Building an AWS data perimeter
Least-privilege IAM says what a principal can do, not who can reach your data or from where. What a data perimeter is and the four controls that build one.