Blog
Bug bounty writeups, security research, and lessons from the hunt.
Apr 2026
I Spent a Day Hunting Netflix's Law Enforcement Portal
Source maps, archived JavaScript, and a hardcoded Contentful token — plus the twist that someone had already reported it five months earlier.
Mar 2026
Building a Transformer-Based End-to-End Web Application Firewall (WAF) Pipeline
Replacing signature matching with learned behavior: a fine-tuned DistilBERT at a Layer 7 reverse proxy that scores every request and decides whether to allow, challenge, or block it.