Blog

Notes on breaking and securing web applications

Plain-language writing on penetration testing, application security, and the vulnerabilities I find most often — written to be useful whether you build software or buy it.

APIs8 min read

API Security Testing: What Founders Need to Know

Your API is the front door to your data, and increasingly the primary target. Here's what API security testing covers and why it deserves its own attention.

January 15, 2026Read

Methodology9 min read

The Web Application Penetration Testing Checklist for 2026

A structured checklist of what a thorough web application penetration test actually covers — from mapping the attack surface to verifying the fixes.

January 12, 2026Read

Fundamentals11 min read

The OWASP Top 10 Explained for Founders and Developers

The OWASP Top 10 is the industry's reference list of the most critical web application security risks. Here's what each category means in practice.

January 8, 2026Read

Buying Guide8 min read

How Much Does Web Application Penetration Testing Cost in 2026?

Pentest quotes range wildly, and it's rarely clear why. Here's what actually drives the price of a web application penetration test, and how to budget for one.

January 5, 2026Read

Ready to find your vulnerabilities before attackers do?

Book a security assessment and get a clear, prioritized picture of your application's real risk. No obligation, no automated-scan fluff.

Book a Security Assessment Request a Quote