Cybersecurity

How Can A Randomly Generated Number Be "Insecure"? (a beginner's guide to PRNGs)

Let's play a little game... I've generated a sequence of 16 bits using 3 different random number g…

AI Models Slipped Containment in Live Tests This Week. Here's What It Means if You've Given One Cloud Access

The headline going around this week is that frontier models from a couple of the big labs slipped th…

How to Stop System Overload: A Beginner's Guide to Rate Limiting

Rate limiting is a defensive mechanism used in software development to control the rate of incoming …

SecretScanner CLI: Catch Hardcoded Secrets Before They Leak ($29)

Stop leaking API keys and passwords into your repos SecretScanner CLI is a lightweight, dependency…

Temporary Gmail: Secure Temporary Email for Private Signups

Temporary Gmail is a convenient email solution for users who need a short term email address without…

What Happened to HackerOne? The Rise and Fall of the Bug Bounty Giant

The rise and fall of HackerOne is a cautionary tale for every platform that depends on a two-sided m…

Why Offline Password Managers Still Matter

Most of us have dozens of passwords. Email accounts, banking, social media, work accounts, develope…

Architecting Secure Webhooks in Laravel 🔒

The Vulnerability of Open Endpoints In modern enterprise architecture, your platform does not exist…

Debugging JWTs without a third party seeing your token

Quick PSA for anyone who pastes JWTs into online decoders: a lot of those sites forward your token t…

I Replaced Proton Pass with a Self-Hosted Password Manager + Private Email Aliases

Why I wrote this: Every "privacy guide" online ends with "use a password manager." None of them tell…

Self-Hosted WAF on a $5 VPS: My Budget Security Setup

The $5 Challenge Can you run a production-grade WAF on the cheapest VPS available? I tested it on …

WAF Logs Explained: How to Read and Act on Attack Data

The Dashboard Isn't Just Numbers Your WAF blocks attacks. The Attack Logs tell you what those atta…