WRITEUPS
Notes from real testing — and the tools I built for it.
Short, practical write-ups on access control, evidence hygiene and the open-source tooling I use on every engagement. No fluff, no invented case studies.
A pre-launch web application security checklist
The checks worth running before a web app or API goes live — access control, authentication, input handling, APIs, configuration and dependencies.
finding-forge: draft, score and lint a report before you submit
Draft, score (CVSS 3.1) and lint HackerOne / Bugcrowd reports before you submit — a completeness check plus a leaked-secret gate.
evidence-redaction-gate: a fail-closed gate for your evidence
A fail-closed, offline gate that stops secrets and PII leaking into security-research evidence before you attach it anywhere.
redact-request: share the shape of a request, never its contents
Print the shape of a captured HTTP request — method, path, header names, body structure — never the values. Share a request without sharing your session.
har-sanitizer: share HTTP evidence without leaking secrets
Redact secrets and PII — cookies, JWT/bearer tokens, API keys, emails, Luhn-checked cards — from HAR, raw HTTP and curl before it goes into a report.
wp-authz-audit: find the reachable code, and what guards it
Find the WordPress plugin code an attacker can reach — and check whether anything is actually guarding it.
wp-hook-guard: map every reachable WordPress entry point
A static analyzer that maps every user-reachable WordPress entry point — AJAX, admin-post, REST, init — and flags the ones missing an authorization or nonce check.
authz-differ: catch broken access control by diffing responses
Replay one HTTP request under multiple identities and diff the responses to catch IDOR, BOLA and missing authorization — credentials redacted, evidence block ready to paste.
ReADQuest: enforce bug-bounty scope in the browser
A Manifest V3 Chrome extension that enforces bug-bounty scope with declarativeNetRequest — so out-of-scope hosts never even receive a request.
scope-sentinel: stay inside scope, provably
A small, offline tool that confirms a URL, host or IP is in scope before you touch it — wildcards, CIDR, URL-prefix rules, deny-beats-allow, JSON output and CI exit codes.