File Upload Testing for QA and Security Teams: 4 Checks to Automate
Build file upload tests for QA, pentesting, and CI. Cover spoofed types, archive attacks, server validation, storage, and cleanup with OWASP guidance.
Field notes
What we keep finding, and what to do about it.
Notes from real engagements, sanitised. No listicles, no vendor comparisons, no "5 cyber threats to watch". If we write something up, it is because we saw it more than once and the fix is worth knowing.
Latest
Password Reset Security: Turn OWASP and NIST Rules Into Tests
Turn password reset security guidance from OWASP and NIST into practical tests for tokens, delivery, abuse controls, sessions, and reset page bypasses.
Read it →Attack Surface Review: Discovery Every 7 Days Still Needs Human Checks
Learn how an attack surface review connects discovery, asset fields, KEV, MITRE ATT&CK, and SSVC, then pairs automation with human verification.
Stop Double Spend: Fix 3 Business Logic Flaws Engineers Overlook
Compact technical guide for engineers to detect and prevent business logic flaws. Learn OWASP state models, SeGa semantic tests, atomic DB fixes, and...
30/60/90 Secure SDLC Practices Playbook for Engineering Teams
Playbook for engineering teams. Map major standards into a 30/60/90 rollout and pair CI automation with manual tests to cut noise and speed fixes.
3 Stage Multi Tenant Security Roadmap for Engineers: RLS Verification
Practitioner cheat sheet for engineers: apply OWASP and NIST zero trust, verify RLS with database first tests, and follow a 3 stage roadmap.
SAST vs DAST: 5-Step CI/CD Runbook for Developers & Security Teams
Evidence-backed SAST vs DAST for developers and security teams. Learn NIST/OWASP guidance, CI/CD scan timing, and a 5-step runbook to combine static and...
Security Teams: Copy Ready Penetration Testing Report Templates
Copy ready penetration testing report templates and an annotated sample for security teams. Reproducible finding fields, CVSS prioritization, and a...
Set API Rate Limits Above P95, OWASP, NGINX and Azure for Developers
For developers: API rate limiting using token bucket or sliding window with OWASP tuning. Set limits above P95 and test with NGINX and Azure.
IDOR Vulnerability: 6 Steps to Test and Fix for Developers
Hands on, test first IDOR guide for developers: follow a 6 step checklist of account swaps, method checks, and server side authorization fixes.
API Penetration Testing That Finds BOLA With ID Swaps: OWASP Aligned
Practitioner workflow for API penetration testing aligned to OWASP API Top 10. Lab-ready setup, cross-user ID tests, GraphQL/gRPC checks, and manual...
Audit Ready ISO 27001 Pentesting: Map Tests to A.8.8 and A.8.29
Make ISO 27001 pentesting audit-ready. Map tests to Annex A controls A.8.8 and A.8.29, align scope and ROE, and keep report, remediation, and retest...
Methodology First OWASP Web Application Penetration Testing for Teams
Methodology first, OWASP-aligned guide for security teams. Follow a stepwise testing process, gather proof of concept evidence, and deliver...
Continuous Penetration Testing: 90/180/365 Roadmap & CI/CD Checklist
90/180/365 roadmap and checklist to add continuous penetration testing to CI/CD and ASM, pairing automated scans with human verification.
Audit Ready SOC 2 Penetration Testing: Map Findings to Controls
Prepare SOC 2 penetration testing evidence auditors accept. Use the checklist, map every finding to TSC controls, schedule testing 8–12 weeks before...
Security Teams: Vulnerability Prioritization by Exploit Risk, Not CVSS
Operational playbook for security teams: prioritize vulnerabilities by exploit evidence (KEV, EPSS), asset criticality, runtime validation, and practical...
Control verification checklist for web apps: pre-prod vs production-like testing, evidence, and human-verified findings (2026)
Control verification checklist for web apps: pre-prod vs production-like testing, evidence, and human-verified findings (2026) In 2026, 7,851% growth in agen...
Prompt-injection testing for AI apps
A test plan for web apps that call an LLM: threat model, what to instrument, OWASP-mapped test cases, and evidence engineering can act on.
What SaaS penetration testing covers
Identity, sessions, multi-tenant authorisation and API access control — the SaaS-specific failures a general web application test tends to miss.
Sanitization vs Validation: the architectural choice that prevents code injection
Sanitization vs Validation: the architectural choice that prevents code injection In 2026, injection attacks still punch through teams that treat input handl...
5 signs your security report is noise
How to tell a report that found something from one padded with scanner output: severity inflation, no reproduction steps, and no verified impact.
Vertical vs horizontal privilege escalation: which threatens your database more?
Vertical vs horizontal privilege escalation: which threatens your database more? In practice, privilege escalation is one of the most exploited stages in the...
Checkout logic flaws scanners miss
The vulnerability classes hiding in a custom checkout that no automated scanner will flag: price tampering, coupon races, and forged payment webhooks.