Everything I've Written
2026
2025
Palo Alto Networks Firewall Configs Exposed in Public S3 Buckets
Public S3 buckets on a Palo Alto Networks AWS account held firewall configs, internal IPs and bootstrap files with admin password hashes. Getting them closed took more than nine months.
Automating Portainer-Hosted TeslaMate Backups to Google Drive
rclone, a small shell script and a cron job, adapted for running TeslaMate under Portainer.
Self-XSS in Stirling-PDF's Merge Feature
Unsanitised PDF file names were rendered straight into the result page, so HTML and JavaScript in a file name got executed.
2024
Command Injection in the es-hangul GitHub Actions Workflow
An unsanitised workflow input interpolated straight into a shell step, allowing arbitrary commands to run in the workflow.
Admin-Scoped Algolia API Key Exposed in Vite
An Algolia key with full create, read, update and delete rights was sitting in the Vite docs config and the page source.
Fantastic GraphQL Bugs and Where to Find Them
The write-up of my OWASP NZ Day 2022 talk, covering the GraphQL issues we kept finding on pentests and how to lock them down.
Hello World!
The first post on the site.