Notes and writeups

What we learn while building products and while breaking them.

• 12 Nov 2026 · 3 min read · Case study

  How an open storage bucket exposed records on over 500,000 Ghanaian graduates

  In 2021 researchers found a National Service Secretariat cloud bucket open to the internet. This is what the public report says happened, why it happens so often, and how to check your own storage in 5 minutes.

• 11 Nov 2026 · 2 min read · Security

  What a pentest report should contain

  A report is only worth paying for if your developers can act on it. Here is what to expect on every finding, and what to send back if it is missing.

• 11 Nov 2026 · 2 min read · Build

  9 security checks before you launch a web app

  The problems we find most often in apps that are about to go live. Each one takes minutes to check and is much cheaper to fix before launch than after.