Engineering Blog
Deep dives into application security, system architecture, and production engineering.
Stop Using JWTs for Stateful Sessions
Why defaulting to JWTs for standard web authentication is a security anti-pattern, and how to implement secure, stateful session management with Redis.
SSRF in the Age of AI Agents
Autonomous AI agents that fetch external URLs are trivially vulnerable to SSRF. How to build a zero-trust network boundary for LLM tool execution.
Bypassing Modern Android SSL Pinning with Frida
A deep dive into dynamic instrumentation. How to hook cryptographic functions in memory to bypass custom certificate pinning implementations.
Architecting a Sub-15ms Zero-Trust Gateway
The engineering tradeoffs involved in building an inline security proxy that inspects payloads without adding unacceptable latency to the request lifecycle.
Pragmatic Threat Modeling for Pre-Seed Startups
You don't need a 50-page STRIDE document when you're trying to find product-market fit. Here's how to secure your MVP in 4 hours.
From P4 to P1: How I Earned My First Paid HackerOne Bounty
My first $400 USD bug bounty on HackerOne (Report #3851049, CLEAR program, paid Jul 30 2026): the recon workflow, the severity ladder from P4 to P1, responsible disclosure, and the lessons that turned bounty hunting into a repeatable process.