Menu
SECURITY WORK · DOCUMENTED
The work behindthe work.
Field notes from a cybersecurity hire that investigates, fixes, and verifies—not just reports.
FIELD NOTES · 47
Research with an operational point.
Exploit chains, incident lessons, product guidance, and the reasoning behind the action.
How Two WordPress Core Bugs Chained into Pre-Auth RCE
How REST batch-route confusion, a scalar SQL injection, WordPress's object cache, the Customizer, and a nested REST dispatch formed an unauthenticated path to code execution—and how defenders should respond.
to action.
Concrete paths, defensive response, and what the evidence changes.
How to Use BugBunny
Our recommended BugBunny workflow: point a fresh scan at an authorized target, provide the original, unsanitized HAR when login context matters, and let the agents work autonomously.
Pay-As-You-Go Security Scanning at BugBunny
A transparent look at BugBunny PAYG: the platform fee, usage wallet, June scan-cost distribution, and why estimated costs vary with the security work.
Compliance Automation Software: Automating Evidence Without Automating Assumptions
How compliance automation software should collect evidence, monitor control drift, manage exceptions, and stay connected to security validation.
Secure Software Development Lifecycle: Building Security Into the Work
A practical secure software development lifecycle guide covering requirements, threat modeling, code review, testing, release, and feedback loops.
Open Source Vulnerability Management: Fixing Dependency Risk Without Alert Fatigue
How to manage open-source vulnerabilities using SBOMs, SCA, reachability, ownership, patching, exceptions, and supply-chain validation.
Attack Surface Management Tools: How to Evaluate Discovery, Context, and Validation
How to choose attack surface management tools that find exposed assets, assign owners, prioritize risk, and support validation.
Identity and Access Management Security: The Control Plane Attackers Target
A practical guide to IAM security across users, service accounts, roles, tokens, cloud permissions, reviews, and monitoring.
Continuous Penetration Testing: Keeping Security Testing Close to Change
How continuous penetration testing differs from annual testing and how to use it for APIs, cloud, code, and attack-surface changes.
API Vulnerability Scanner: What to Automate and What to Validate Manually
How to evaluate an API vulnerability scanner for authenticated coverage, schema testing, authorization, abuse cases, and remediation.
Software Supply Chain Security: Protecting the Path From Commit to Production
A practical software supply chain security guide for dependencies, CI/CD, build systems, artifacts, secrets, provenance, and developer tooling.
Cloud Security Posture Management: From Misconfigurations to Attack Paths
How cloud security posture management should prioritize misconfigurations by identity, exposure, data sensitivity, and exploitability.
Automated Vulnerability Scanner: What It Can Find and What It Will Miss
How to use an automated vulnerability scanner for coverage while avoiding false confidence around auth, logic, chained impact, and context.
API Security Best Practices for Production APIs
A production-focused API security checklist covering auth, object access, schemas, rate limits, secrets, logging, and testing.
Cloud Native Security Solution: What to Demand Before You Buy
How to evaluate a cloud native security solution across identity, workloads, Kubernetes, APIs, CI/CD, posture, and runtime validation.
ISO 27001 Compliance: Turning an ISMS Into Working Security Controls
A practical ISO 27001 compliance guide for risk assessment, control selection, evidence, audits, and technical validation.
Best Practices for API Security That Reduce Real Abuse
API security best practices for authentication, authorization, rate limiting, schema validation, logging, and abuse-case testing.
SAST and DAST: How to Combine Static and Dynamic Testing
How SAST and DAST complement each other, what each misses, and how to build a high-signal application security workflow.
Docker Container Security: Hardening Images, Runtime, and Delivery
A practical Docker container security guide for base images, users, secrets, capabilities, registries, CI/CD, and runtime validation.
DevSecOps Automation Tools: What to Put in the Pipeline and What to Keep Out
A practical guide to DevSecOps automation tools for secrets, SAST, SCA, containers, IaC, DAST, API security, and remediation workflows.
Software Audit Compliance: Making Engineering Evidence Audit-Ready
How software audit compliance connects code, dependencies, change management, vulnerability remediation, and control evidence.
Vulnerability Management Best Practices for Fixing What Matters First
Practical vulnerability management best practices for prioritization, ownership, remediation, exceptions, and validation.
What Is Static Code Analysis? A Security-Focused Explanation
What static code analysis does, where it helps, where it fails, and how to use it for high-signal application security.
Security Risk Assessment: How to Turn Unknowns Into Owned Work
A practical security risk assessment workflow for assets, threats, vulnerabilities, controls, impact, likelihood, and remediation.
Autonomous vs Automated Security: What the Difference Means in Practice
A practical comparison of autonomous vs automated security workflows, including review gates, context, control, and accountability.
NIST SP 800-53 Controls: Turning a Large Catalog Into Operational Security
How to work with NIST SP 800-53 controls without losing the connection to systems, owners, evidence, and technical validation.
Audit and Compliance Software: What It Should Prove, Not Just Store
How audit and compliance software should manage controls, evidence, exceptions, policies, owners, and security validation.
Web Application Security: The Controls That Still Matter Most
A practical web application security guide for authentication, authorization, input handling, session safety, headers, logging, and testing.
Continuous Attack Surface Management: What to Watch After the Inventory
How continuous attack surface management helps teams find exposed assets, stale services, shadow APIs, and risky changes.
Vulnerability Management Platforms: How to Choose for Signal, Ownership, and Fix Velocity
How vulnerability management platforms should prioritize findings, assign owners, track remediation, and reduce real exposure.
DAST vs Penetration Testing: What Each Finds and When to Use Both
A clear comparison of DAST and penetration testing for application security programs that need coverage and exploit validation.
NIST Control Families: A Practical Reference for Security Teams
A practical reference to NIST control families and how to turn framework language into testable security controls.
Security Testing for API: A Practical Workflow for Modern Teams
How to run security testing for API endpoints across authentication, authorization, rate limits, input validation, and business logic.
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
What insecure direct object reference means, how IDOR bugs happen, and how to test object-level authorization before release.
Secure Code Review: How to Find Boundary Failures Before Release
A practical guide to secure code review focused on authentication, authorization, injection, data flow, secrets, and business logic.
DevSecOps Best Practices for Teams That Ship Every Week
A practical DevSecOps best-practices guide covering pull requests, CI/CD, secrets, dependencies, cloud configuration, and feedback loops.
Software Composition Analysis: Beyond Dependency CVE Lists
How software composition analysis helps teams manage open-source dependency, license, supply-chain, and reachability risk.
Database Security Best Practices That Survive Real Incidents
A concise database security checklist for access control, encryption, backups, query exposure, secrets, logging, and incident readiness.
Automating Code Review Without Training Developers to Ignore It
A step-by-step guide to automating code review with high-signal checks, security context, and sane pull-request workflow design.
Container Vulnerability Scanning: Finding the Issues That Actually Ship
How to use container vulnerability scanning to reduce exploitable image, package, secret, and runtime risk without drowning in CVEs.
Automated Code Review: What to Trust, What to Verify, and What to Keep Human
A practical security guide to automated code review for engineering teams that need faster feedback without shallow findings.
Incident Response Automation: Where Speed Helps and Where Humans Still Matter
How to use incident response automation for containment, enrichment, evidence preservation, and repeatable security operations.
Intrusion Detection Systems: What They Catch and Where They Fail
A practical guide to intrusion detection systems, including telemetry quality, detection coverage, false positives, and response handoff.
SOC 2 Compliance Software: A Practical Guide for 2026
How to evaluate SOC 2 compliance software by evidence quality, control ownership, audit readiness, and continuous security validation.
GitHub's VS Code Extension Breach Was a Developer-Device Failure
A technical postmortem on the May 2026 GitHub internal repository breach, poisoned IDE extensions, workspace trust, and how BugBunny helps prevent developer-tooling incidents before they become repository breaches.
Precision Over Volume: Why BugBunny's Signal Stands Out
BugBunny's public record is defined by precision: 89+ CVEs, No. 1 HackerOne Business ranking, and disciplined disclosure that emphasizes relevance over noise.
How We Found 5 Ways to Hack Any Developer Using Google Gemini CLI
Clone a repo. Type gemini. In 3 seconds, an attacker has your AWS keys, GitHub tokens, and everything else in your environment.
READY FOR REAL WORK