Writing

Technical writeups

Notes from labs, secure-architecture decisions, and what each bug changed about how I build.

#firebase1
#secure-design1
#web1
#access-control1
#owasp1
#labs1

Jul 22, 2026·3 min

The client is not the boundary: hardening a Firebase app

Firebase makes it trivially easy to talk to the database from the browser. That is the feature, and it is also the entire threat model — notes from tightening a stack I use every day.

#firebase
#secure-design
#web

Jun 14, 2026·3 min

Access control is not a UI problem

Working through the access-control labs changed how I read my own code. The pattern behind almost all of them is the same, and I had shipped it more than once.

#access-control
#owasp
#labs