// ethical hacking, plainly explained

Security you can actually apply.

Practical write-ups on AI security, web app testing, code review and DevSecOps, from someone who does the work.

Explore all guides Browse courses

					review: auth/login.php
					SQL injection
				
$email = $_POST['email'];
- $q = "SELECT * FROM users WHERE email='$email'";
+ $stmt = $pdo->prepare(
+   "SELECT * FROM users WHERE email = ?");
+ $stmt->execute([$email]);
$user = $stmt->fetch();

Browse by topic

Six areas, all written to be applied on real systems.

AI

LLM security, prompt injection and AI-assisted tooling.

Web Sec

OWASP Top 10, auth flaws and hardening real apps.

Pentest

Hands-on testing techniques for labs and authorised targets.

DevSecOps

Security checks wired into your CI/CD pipeline.

Code Review

Spotting vulnerabilities in real diffs, line by line.

Courses

Structured, hands-on learning paths.

Explore all guides

Latest write-ups

All AI Web Sec Pentest DevSecOps Code Review Courses

Web Sec

BOLA vs BFLA: Authorization Bugs in a REST API

Tell object-level and function-level authorization bugs apart in a local orders API: read another user's order, call an admin function…

November 9, 2026 · 15 min read

Code Review

Reviewing an AI-written Express PR: five bugs that pass the tests

Review a "works and tests are green" Express pull request in a local Docker lab: prove stored XSS, log injection,…

November 9, 2026 · 17 min read

Code Review

Reviewing a Dockerfile and Kubernetes manifest PR: secrets in layers, root containers and privileged pods

Review a container PR where "cleaned up the secrets" left a key in the image layers and the pod is…

November 9, 2026 · 14 min read

Code Review

Secure code review in Django: when annotate(**request.GET) becomes SQL injection

Review a Django PR that reintroduces the CVE-2025-57833 pattern, prove the FilteredRelation alias SQL injection in your browser against a…

November 9, 2026 · 17 min read

DevSecOps

Slopsquatting: When Your AI Assistant Invents a Dependency, and the CI Gate That Stops It

AI assistants repeatedly invent package names that anyone can register; build a local registry lab, watch a vulnerable CI pipeline…

November 8, 2026 · 16 min read

DevSecOps

When the Issue Tracker Gives Orders: Prompt Injection Against AI Agents in CI/CD

A triage bot that pastes issue text into its prompt can be steered by an attacker who only has permission…

November 8, 2026 · 16 min read

Courses

OWASP Top 10:2025 — The Hands-On Course

Ten modules, ten Docker labs. Exploit and fix every category in the OWASP Top 10:2025 yourself, on your own machine.

November 8, 2026 · 5 min read

Web Sec

PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Verify, Detect and Patch the PHP Worker RCE Pair

Two critical PHP flaws in request-memory handling were fixed on 2026-10-21; this lab shows how to verify your version, try…

November 4, 2026 · 12 min read

Web Sec

Stack Traces, Stuck Locks, and Stolen Funds: When Error Handling Is the Vulnerability (OWASP A10:2025)

Build a Flask app that leaks a processing-slot lock and a stack trace on unhandled exceptions, exploit both into a…

October 8, 2026 · 12 min read

// courses

Hands-on security courses are on the way.

Join the waitlist to hear when the first course opens.

// weekly roundup

One email a week with the security news that matters to builders.

A short roundup plus the newest tutorial. Unsubscribe any time.