Writing
// 07 entries2026-08-02 Vuln Bank Part 1: Tech Stack & Architecture The stack behind the vuln bank — Effect, Hono, Postgres — and the one idea that shapes everything: the RAG system and the MCP interface are two separable pieces that only happen to ship together. 8 MIN 2026-08-02 Building a Vuln Bank for My Hackbot Kicking off a series on giving an autonomous bug-hunting agent a long-term memory — a curated vulnerability knowledge base served over MCP, and the tradeoffs behind it. 6 MIN 2026-05-14 CVE-2026-31419: Heap Overflow in an MQTT Broker A malformed CONNECT packet, a 40-byte overwrite, and a weekend of heap grooming. 12 MIN 2026-04-02 JWT alg:none, Ten Years Later Why a bug class we "fixed" in 2015 still shows up in production APIs — and how to hunt it in modern stacks. 8 MIN 2026-03-11 Lessons From My First Kernel Bug Bounty Six months, one dangling pointer, and everything I'd tell myself before starting. 10 MIN 2026-02-08 Fuzzing Embedded Parsers with AFL++ and QEMU A practical harness-building walkthrough: from firmware blob to first crash in an afternoon. 15 MIN 2026-01-19 What Burnout Taught Me About Threat Modeling My Own Life Attack surface isn't just for software. A personal post about limits, recovery, and sustainable research. 6 MIN