tail -f ~/notes

Writing

Concepts from the proof, explained in my own words with code from my own systems.

The scope of a credential should be inversely proportional to its lifetime

A driver phone must hold a working credential for nine hours with no way to check in. The standard playbook does not work here, and pretending it does would be the first vulnerability.

23 Jul 2026· 2 min

Node.js Pentesting OWASP Offline-first

Order of checks is a security property

The same allowlist, the same resolver, the same logic. Move one check after the other and an attacker can smuggle a price change through a genuine delivery.

22 Jul 2026· 1 min

Node.js OWASP Pentesting