// ethical hacking, plainly explained

Security you can actually apply.

Practical write-ups on AI security, web app testing, code review and DevSecOps, from someone who does the work.

Explore all guides Browse courses

					review: auth/login.php
					SQL injection
				
$email = $_POST['email'];
- $q = "SELECT * FROM users WHERE email='$email'";
+ $stmt = $pdo->prepare(
+   "SELECT * FROM users WHERE email = ?");
+ $stmt->execute([$email]);
$user = $stmt->fetch();

Browse by topic

Six areas, all written to be applied on real systems.

AI

LLM security, prompt injection and AI-assisted tooling.

Web Sec

OWASP Top 10, auth flaws and hardening real apps.

Pentest

Hands-on testing techniques for labs and authorised targets.

DevSecOps

Security checks wired into your CI/CD pipeline.

Code Review

Spotting vulnerabilities in real diffs, line by line.

Courses

Structured, hands-on learning paths.

Explore all guides

Latest write-ups

All AI Web Sec Pentest DevSecOps Code Review Courses

Pentest

HTTP Request Smuggling: Find It, Fix It, and Detect It

A defender's walkthrough of HTTP request smuggling (CWE-444): why a reverse proxy and its back-end can disagree about where a…

November 11, 2026 · 11 min read

AI

Indirect Prompt Injection: Hijacking a Tool-Using AI Agent

Poison a web page and an e-mail to make a mock AI agent leak a fake secret in a local…

November 11, 2026 · 11 min read

Pentest

Pentesting an MCP Server: One Unauthenticated Route to Full Control

An AI agent's MCP server can expose two HTTP endpoints and guard only one of them. Build a local DevOps-assistant…

November 11, 2026 · 13 min read

Web Sec

BOLA vs BFLA: Authorization Bugs in a REST API

Tell object-level and function-level authorization bugs apart in a local orders API: read another user's order, call an admin function…

November 9, 2026 · 15 min read

Code Review

Reviewing an AI-written Express PR: five bugs that pass the tests

Review a "works and tests are green" Express pull request in a local Docker lab: prove stored XSS, log injection,…

November 9, 2026 · 17 min read

Code Review

Reviewing a Dockerfile and Kubernetes manifest PR: secrets in layers, root containers and privileged pods

Review a container PR where "cleaned up the secrets" left a key in the image layers and the pod is…

November 9, 2026 · 14 min read

Code Review

Secure code review in Django: when annotate(**request.GET) becomes SQL injection

Review a Django PR that reintroduces the CVE-2025-57833 pattern, prove the FilteredRelation alias SQL injection in your browser against a…

November 9, 2026 · 17 min read

DevSecOps

Slopsquatting: When Your AI Assistant Invents a Dependency, and the CI Gate That Stops It

AI assistants repeatedly invent package names that anyone can register; build a local registry lab, watch a vulnerable CI pipeline…

November 8, 2026 · 16 min read

DevSecOps

When the Issue Tracker Gives Orders: Prompt Injection Against AI Agents in CI/CD

A triage bot that pastes issue text into its prompt can be steered by an attacker who only has permission…

November 8, 2026 · 16 min read

// courses

Hands-on security courses are on the way.

Join the waitlist to hear when the first course opens.

// weekly roundup

One email a week with the security news that matters to builders.

A short roundup plus the newest tutorial. Unsubscribe any time.