RAMYA LAKHANI

Log

Field notes from learning to attack the code I ship. Rough, dated, unpolished on purpose.

  1. #003

    Model output must never become markup, and a security corpus makes escaping wrong too

    • xss
    • llm
    • frontend
  2. #002

    A disabled control reads as a broken one, so refuse on the server instead

    • ux
    • api-design
    • error-handling
  3. #001

    The scan endpoint on this site is an SSRF by design, so the allowlist is the feature

    • ssrf
    • cloudflare-workers
    • api-design