Practical, no-fluff writeups on performance, security, browser auditing, and code quality.
Why GraphQL introspection and public Swagger or OpenAPI docs help attackers map your API, when it is fine to leave them on, and how to disable GraphQL introspection in production.
More Security
What a subdomain takeover is, how dangling CNAME records let attackers serve content on your domain, which services are affected, and how to find and fix them.
What is DMARC and why does every domain need it? How DMARC works with SPF and DKIM, how to read a DMARC record, and a safe path from p=none to p=reject.
AI coding agents load rules files as trusted instructions. The rules file backdoor hides attacker instructions in them with invisible Unicode and comments. Here is how it works and how to check your repo.
An AI bill of materials lists every model, AI provider, framework and agent tool your software depends on. Here is what belongs in an AI BOM, the standard formats, and how to generate one from your code.
The OWASP LLM Top 10 lists the biggest security risks in apps built on large language models. Here is each risk in plain language, real examples, the newer OWASP Agentic Top 10, and what you can check in your own code.
MCP servers run with your developer permissions and feed text straight into your AI agent. Here are the MCP security risks that have already been exploited, and the config checks that stop them.
The official OWASP Top 10 2025 explained, mapped category by category against the OWASP Top 10 2021, plus the OWASP Top 10 for LLM Applications 2025 and what a scan can actually test.
What a cyber security platform really is, how a data security platform, cloud security platform and cloud native security platform differ, and how to choose the layers your team needs.
SSL Labs' exhaustive protocol enumeration set the standard for TLS testing - but cached results and no scheduling send people looking for alternatives. Here's an honest comparison, including the one thing a single-connection check genuinely can't match.
