Reports and analysis

Research

Long-form write-ups, and shorter notes on what comes up in the work: disclosure channels, tooling mistakes, and where the boundary of a vulnerability actually sits.

All · 4 Analysis · 2 Commentary · 2
Topics Disclosure · 1 CWE-295 · 1 WPScan · 1 Patchstack · 1 Artificial Intelligence · 1 AI · 1 Software Engineering · 1 Programming · 1 Python · 1 Database · 1 Database Indexing · 1 Performance Optimization · 1 Software Development · 1 Clinic Management System · 1
Analysis 2026-07-29 · 4 min

WPScan rejects the entire MITM class, whatever the impact

A scope rejection is not a duplicate. Knowing the difference decides which channel you go to next.

DisclosureCWE-295WPScanPatchstack
Analysis

Blinding the Watchdog: A ZIP Parser Differential in GuardDog

GuardDog is a security scanner built to catch malicious PyPI and npm packages — but it trusted whatever Python's zipfile enumerated from an archive's central directory. A wheel can be crafte...

GuardDogDatadogSupply Chain SecurityParser DifferentialCWE-436Interpretation ConflictZIPPython WheelPyPIResponsible DisclosureStatic Analysis
2026-06-24
7 min
Commentary

AI Can Write Code, But It Cannot Replace Software Engineering Experience

A recent experience investigating a failing clinic management system revealed a growing problem in the software industry: treating AI-generated code as a substitute for software engineering...

Artificial IntelligenceAISoftware EngineeringProgrammingPythonDatabaseDatabase IndexingPerformance OptimizationSoftware DevelopmentClinic Management SystemAI Generated CodeSoftware Architecture
2025-03-27
6 min