// ethical hacking, plainly explained

Security you can actually apply.

Practical write-ups on AI security, web app testing, code review and DevSecOps, from someone who does the work.

Explore all guides Browse courses

					review: auth/login.php
					SQL injection
				
$email = $_POST['email'];
- $q = "SELECT * FROM users WHERE email='$email'";
+ $stmt = $pdo->prepare(
+   "SELECT * FROM users WHERE email = ?");
+ $stmt->execute([$email]);
$user = $stmt->fetch();

Browse by topic

Six areas, all written to be applied on real systems.

AI

LLM security, prompt injection and AI-assisted tooling.

Web Sec

OWASP Top 10, auth flaws and hardening real apps.

Pentest

Hands-on testing techniques for labs and authorised targets.

DevSecOps

Security checks wired into your CI/CD pipeline.

Code Review

Spotting vulnerabilities in real diffs, line by line.

Courses

Structured, hands-on learning paths.

Explore all guides

Latest write-ups

All AI Web Sec Pentest DevSecOps Code Review Courses

Code Review

Reviewing a Dockerfile and Kubernetes manifest PR: secrets in layers, root containers and privileged pods

Review a container PR where "cleaned up the secrets" left a key in the image layers and the pod is…

November 9, 2026 · 14 min read

Code Review

Secure code review in Django: when annotate(**request.GET) becomes SQL injection

Review a Django PR that reintroduces the CVE-2025-57833 pattern, prove the FilteredRelation alias SQL injection in your browser against a…

November 9, 2026 · 17 min read

DevSecOps

Slopsquatting: When Your AI Assistant Invents a Dependency, and the CI Gate That Stops It

AI assistants repeatedly invent package names that anyone can register; build a local registry lab, watch a vulnerable CI pipeline…

November 8, 2026 · 16 min read

DevSecOps

When the Issue Tracker Gives Orders: Prompt Injection Against AI Agents in CI/CD

A triage bot that pastes issue text into its prompt can be steered by an attacker who only has permission…

November 8, 2026 · 16 min read

Courses

OWASP Top 10:2025 — The Hands-On Course

Ten modules, ten Docker labs. Exploit and fix every category in the OWASP Top 10:2025 yourself, on your own machine.

November 8, 2026 · 5 min read

Web Sec

PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Verify, Detect and Patch the PHP Worker RCE Pair

Two critical PHP flaws in request-memory handling were fixed on 2026-10-21; this lab shows how to verify your version, try…

November 4, 2026 · 12 min read

Web Sec

Stack Traces, Stuck Locks, and Stolen Funds: When Error Handling Is the Vulnerability (OWASP A10:2025)

Build a Flask app that leaks a processing-slot lock and a stack trace on unhandled exceptions, exploit both into a…

October 8, 2026 · 12 min read

Web Sec

Silent Brute Force: Building Detection When Your Logs Say Nothing (OWASP A09:2025)

Build a Flask login app with no logging, watch a brute-force attack vanish without a trace, then add structured JSON…

October 8, 2026 · 11 min read

Web Sec

RCE via Pickle: Exploiting Insecure Deserialization and Restoring Data Integrity (OWASP A08:2025)

Build a Flask app vulnerable to pickle.loads() RCE, craft a working __reduce__ exploit, then fix it with JSON schema validation…

October 8, 2026 · 12 min read

// courses

Hands-on security courses are on the way.

Join the waitlist to hear when the first course opens.

// weekly roundup

One email a week with the security news that matters to builders.

A short roundup plus the newest tutorial. Unsubscribe any time.