Security-minded dev writing about APIs, auth and web hardening.
About
Application security engineer in Austin, mostly reviewing APIs and the auth flows around them. I write about the bugs that survive code review: missing authorization checks, token lifetimes, and trust boundaries that nobody drew. Everything here is from systems I have permission to test, with details changed.