https://us01qzz.jp2haozu-naookg-okak.cc/A slow blog about application security and the craft of shipping software.en https://us01qzz.jp2haozu-naookg-okak.cc/posts/ssrf-explained-through-real-world-mistakes.htmlhttps://us01qzz.jp2haozu-naookg-okak.cc/posts/ssrf-explained-through-real-world-mistakes.htmlWed, 26 Aug 2026 09:00:00 +0000For a long time I treated SSRF as something to worry about later. Then a small change to our Burp Suite setup turned into a week of debugging, and "later" arrived all at once. https://us01qzz.jp2haozu-naookg-okak.cc/posts/least-privilege-for-humans-not-just-services.htmlhttps://us01qzz.jp2haozu-naookg-okak.cc/posts/least-privilege-for-humans-not-just-services.htmlMon, 11 May 2026 09:00:00 +0000This post started as a note to my future self. Every few months I relearn the same lessons about least privilege, so this time I'm writing them down. https://us01qzz.jp2haozu-naookg-okak.cc/posts/security-reviews-that-developers-don-t-dread.htmlhttps://us01qzz.jp2haozu-naookg-okak.cc/posts/security-reviews-that-developers-don-t-dread.htmlTue, 14 Apr 2026 09:00:00 +0000Every codebase has one area everyone is a little afraid to touch. On our team, it was everything related to least privilege. https://us01qzz.jp2haozu-naookg-okak.cc/posts/session-cookies-done-right.htmlhttps://us01qzz.jp2haozu-naookg-okak.cc/posts/session-cookies-done-right.htmlSun, 30 Nov 2025 09:00:00 +0000This post started as a note to my future self. Every few months I relearn the same lessons about supply chain security, so this time I'm writing them down. https://us01qzz.jp2haozu-naookg-okak.cc/posts/signing-container-images-with-sigstore.htmlhttps://us01qzz.jp2haozu-naookg-okak.cc/posts/signing-container-images-with-sigstore.htmlTue, 25 Nov 2025 09:00:00 +0000This post started as a note to my future self. Every few months I relearn the same lessons about dependency pinning, so this time I'm writing them down. https://us01qzz.jp2haozu-naookg-okak.cc/posts/rotating-secrets-without-a-maintenance-window.htmlhttps://us01qzz.jp2haozu-naookg-okak.cc/posts/rotating-secrets-without-a-maintenance-window.htmlWed, 16 Jul 2025 09:00:00 +0000A colleague asked me last week why our team cares so much about threat modeling. I gave a rambling answer, so here is the longer, more organized version. https://us01qzz.jp2haozu-naookg-okak.cc/posts/threat-modeling-in-thirty-minutes.htmlhttps://us01qzz.jp2haozu-naookg-okak.cc/posts/threat-modeling-in-thirty-minutes.htmlSun, 01 Jun 2025 09:00:00 +0000There is no shortage of articles about OWASP ZAP. Most of them cover the happy path. This one is about what happened after the happy path ended. https://us01qzz.jp2haozu-naookg-okak.cc/posts/what-a-leaked-api-key-taught-our-team.htmlhttps://us01qzz.jp2haozu-naookg-okak.cc/posts/what-a-leaked-api-key-taught-our-team.htmlMon, 12 May 2025 09:00:00 +0000A colleague asked me last week why our team cares so much about least privilege. I gave a rambling answer, so here is the longer, more organized version.