I’m a Security Engineer with a background in development. I enjoy exploring systems, building things, and learning by testing their limits. Say hi an...
I have been thinking a lot about npm dependencies lately, especially the small ones. Not the big libraries that solve hard problems, but the tiny packages that do one small thing: strip whitespace, pad a string, check a type, or format something simple. A good example is strip-indent , a small package that removes leading whitespace from each line of a string. If you open the source, it is not…
I have been doing bug bounty since 2013. Back then, everything was manual. I used to write my exploits line by line, document every step, and build reports from scratch. It was not easy, and honestly, I did not enjoy writing reports, especially the complex ones. You had to simplify everything clearly to avoid endless back-and-forth during triage. I have also been on the other side, managing bug…
Table of Contents Introduction Discovering the Target Testing with rep+ Client-side Secret Detection JWT Discovery Exploring Supabase Endpoints Validating Row Level Security Password Reset Tokens Scale of Exposure Safe Proof-of-Concept Responsible Disclosure Why rep+ is Valuable Getting rep+ References TL;DR I opened a website, ran rep+ , found a leaked Supabase anon JWT , checked RLS, and…
Table of Contents Introduction Starting with the Basics Diving into Dokploy Final Thoughts Introduction As I was going through Hacker News , a trending topic about Dokku caught my eye. It was the top-ranked post at the time. For those who aren't familiar, Dokku is an open-source Platform as a Service (PaaS) that you can run on your own server. It's often compared to Heroku, but with the added…