Notes and posts
Engineering, AI agents and application security.
Two years to be right
For two years I argued that we were scraping WordPress sites the expensive way.
The table names were in the code
If you want to know what data an application holds, ask the application.
Four claims I withdrew in one day
A researcher who cannot show what he got wrong has no way to show that the rest is right.
Nineteen million rows, one address
One application had a table with 19.7 million rows in it.
A 200 is not the application
A status code proves a page exists. It does not prove the page is the application.
Two passwords across a thousand rows
The platform said the data was real. The data said otherwise.