Representative Foreword
The representative foreword of this blog: security now fails less at finding issues than at absorbing, sustaining, and acting on what has already been found.
This essay frames the entire site first. The posts on technical analysis, method, and governance all start from this same problem statement.
Detection, Method, Governance
The same check-then-act race keeps appearing across services: purchase-limit bypass, one draw used by many requests, duplicate coupon cancellation, daily-reward overruns. I built a real stack (nginx + Tomcat×2 + shared Postgres + Redis) and measured which fix actually holds. Most of them need no Redis lock — just a DB conditional UPDATE and an affected-rows check.
A malicious server corrupting a client that dials out to it, carrying both the libc leak and the second stage over one already-open socket in a single ROP chain. And why this is not a new pattern but a well-known composition.
This article explains how I split an XSS security development specification for small local models into core/verify/dev/test overlays, and what I learned while connecting LLM-based judgment to regression-test generation and Jazzer/Jazzer.js fuzzing seeds.
I designed sec-audit-static workflow v2.0, ran it against a real auth-server codebase, and missed two things. This is the record of how those misses were folded back into the tool — through v2.8.
MCP security risks are not about prompt injection. They stem from the same configuration-to-execution escalation pattern that has plagued RPC, local security software, and CI/CD pipelines for decades.
AI-era security assessment is not primarily about reducing outsourcing cost. It is about embedding repeatable verification into the development process while separating automation candidates from human judgment.
A practical account of applying dataflow-based clustering to a real codebase — reducing 228 endpoints to 5 reviewable clusters, and finding an RCE chain in the cross-section.
We point out the limitations of traditional security diagnostic reports and share the necessity and practical application cases of ‘Security Testing as Code’, managing diagnostic results not as ‘documents’ but as ’executable code (PoC)’.
Automating Snyk vulnerability alert management with Google Apps Script and Gmail when official API access falls short.
A hands-on guide using dnsmasq to filter SVCB and HTTPS records for disabling ECH and enforcing central DNS policies. Notes that DoH requires separate network-layer policies.
