Writing

Security & engineering deep-dives

18 articles on bug bounty, LLM security, distributed systems and ML.

Field notes from real engagements and builds: accepted bug-bounty findings turned into repeatable methodology, LLM agent security research, and the engineering behind systems that hold up in production. Written by Muhammad Ramis, OSCP+ penetration tester and software & AI engineer.

• Forging Trust: JWT Attacks That End in Account Takeovercybersecurity · 2026-06-23 · 9 min readA practitioner's walk through the JWT flaws that actually chain into account takeover, from alg:none and algorithm confusion to weak secrets and header injection, drawn from accepted findings across bug-bounty programmes.
• Second Factor, First Failure: How MFA Gets Bypassedcybersecurity · 2026-06-02 · 9 min readA practitioner walkthrough of the four ways MFA actually falls over in the wild and how each one chains into full account takeover, drawn from accepted findings across YesWeHack, Intigriti and HackerOne programmes.
• Logging In as Anyone: OAuth and SSO Account-Takeover Patternscybersecurity · 2026-05-12 · 9 min readA practitioner's field guide to the OAuth and SSO flaws that turn a login button into full account takeover, drawn from accepted findings across YesWeHack, Intigriti and HackerOne programmes.
• Owning the Reset Flow: Password-Reset Bugs That Lead to Account Takeovercybersecurity · 2026-04-21 · 9 min readA practitioner walkthrough of the password-reset bugs that actually chain into account takeover, from Host header poisoning to weak tokens, drawn from accepted findings across bug-bounty programmes.
• From Self-XSS to Account Takeover: Chaining Web Cache Poisoning on a Public Bug-Bounty Targetcybersecurity · 2026-04-02 · 8 min readA sanitised write-up of how I turned a "won't fix" self-XSS into a zero-click account takeover by abusing a CDN cache that keyed on the wrong inputs. The methodology, the cache key confusion, the payload, the impact rating, and the layered fix.
• A Repeatable Red-Team Harness for LLM Agents: From Corpora to Guardrailsaiml · 2026-03-28 · 8 min readMost teams test LLM agents by poking at them in a chat window. That does not scale and it does not regress. Here is the repeatable harness I built: prompt-injection corpora, tool-abuse scenarios, dual scoring with an LLM judge plus deterministic checks, and a feedback loop that turns findings into guardrails.
• Spending a Voucher Twice in 40ms: A TOCTOU Race Condition in a Payments Flowcybersecurity · 2026-03-19 · 8 min readHow I turned a single-use £25 voucher into £75 of credit by firing three redemption requests inside a 40ms window. A practical walk-through of detecting a TOCTOU double-spend with Burp Turbo Intruder, proving impact without theft, and the row-lock plus idempotency-key fix that closes it.
• Choose Your Lens: Designing a Portfolio for a Multi-Disciplinary Careeruiux · 2026-03-04 · 8 min readHow I redesigned a penetration-tester-and-engineer portfolio around a "choose your lens" entry point: persona-driven theming on a single token set, progressive disclosure that never traps the reader, and motion that respects prefers-reduced-motion.
• An ML Anomaly Detector for Auth Logs That a SOC Actually Trustsaiml · 2026-02-23 · 8 min readA practical walkthrough of building an unsupervised anomaly detector for authentication logs - feature engineering that survives contact with reality, isolation forest versus autoencoder, taming false positives, and giving analysts an explanation they can act on.
• Breaking Tool Trust Boundaries in Agentic Multi-LLM Workflowscybersecurity · 2026-02-09 · 9 min readAgentic LLM systems collapse the boundary between data and instructions, and most of them invoke tools on the model's word alone. Here is how I test that trust boundary, with concrete payloads, a triage harness, and the bugs I report.
• Building BugTraceAI: A 6-Phase Autonomous Security Scanning Pipelineengineering · 2026-01-26 · 9 min readHow I built BugTraceAI, a self-hosted autonomous scanner that pairs Go fuzzers and Playwright with LLM-guided payload mutation across a 6-phase pipeline - and why consensus voting and circuit breakers are what make it usable.
• Event-Driven at Scale: Idempotent Apache Kafka Consumers in Spring Bootengineering · 2025-12-30 · 9 min readKafka gives you at-least-once delivery, which means your consumers will eventually see the same event twice. Here is how I build genuinely idempotent Spring Boot consumers - the transactional outbox, dedup keys, retry and DLQ topics, and a TestContainers harness that proves it under failure.
• Closing 24 GDPR Control Gaps by Wiring Article 30/32 into CI/CDcybersecurity · 2025-12-15 · 8 min readHow I turned GDPR Articles 30 and 32 from a quarterly spreadsheet exercise into automated pipeline gates, closing 24 control gaps and mapping 74 PII fields before they ever reached production.
• From IDOR to Full Account Takeover: A Repeatable Authorization-Matrix Workflowcybersecurity · 2025-11-18 · 8 min readA practical, repeatable method for finding IDOR/BOLA and chaining it into full account takeover, built on a Burp plus Python authorization-matrix workflow. Drawn from accepted findings across YesWeHack and Intigriti programmes.
• Benchmarking Post-Quantum Blind Signatures: Lessons From My MSc Dissertationresearch · 2025-11-02 · 9 min readWhat I learned building a reproducible, multi-language benchmarking framework for post-quantum blind signature schemes - and why honest performance numbers are harder to produce than the schemes themselves.
• Accessibility Is a Security Control: WCAG 2.2 AA in High-Stakes Dashboardsuiux · 2025-10-12 · 7 min readAccessibility is usually filed under compliance, but in security and ops dashboards the same WCAG 2.2 AA requirements that help screen-reader users also harden the interface against confused-operator failures and a whole class of UI-driven security bugs.
• Cutting Scanner Alert Fatigue 61% With an Embeddings-Based LLM Triage Layercybersecurity · 2025-09-30 · 9 min readHow I built an embeddings-and-LLM triage layer over CWE/OWASP notes and historical findings to cut duplicate review on 8,400 weekly scanner alerts by 61% - architecture, consensus voting, and the pitfalls that nearly broke it.
• Engineering a .NET Core Microservices Estate for 99.99% Uptimeengineering · 2025-08-21 · 9 min readHow I took a C#/.NET Core microservices estate to 99.99% availability using Polly resilience policies, AKS rolling updates with Helm, Serilog plus OpenTelemetry tracing, and k6 latency budgets that fail builds before customers feel the pain.