Full stack developer specialising in application security. I review AI-built codebases for auth gaps, exposed secrets and broken access control — and I ship the fixes.https://cyber.ramyalakhani.in/enSun, 09 Aug 2026 00:00:00 GMThttps://cyber.ramyalakhani.in/writeups/secrets-that-survive-gitignore/https://cyber.ramyalakhani.in/writeups/secrets-that-survive-gitignore/Ignoring .env stops one file being committed. It does not stop the value reaching the client bundle, the test fixtures, or the history you already pushed.Sun, 09 Aug 2026 00:00:00 GMTWRITEUPhttps://cyber.ramyalakhani.in/writeups/idor-in-nextjs-route-handlers/https://cyber.ramyalakhani.in/writeups/idor-in-nextjs-route-handlers/Route handlers are just functions. Middleware authenticates the request, then the handler fetches by id and never checks who is asking.Sun, 09 Aug 2026 00:00:00 GMTWRITEUPhttps://cyber.ramyalakhani.in/research/why-ai-generated-code-fails-at-authorisation/https://cyber.ramyalakhani.in/research/why-ai-generated-code-fails-at-authorisation/Assistants are trained to produce code that runs. Authorisation is the one property that cannot be inferred from the surrounding code, because it lives in business rules the model was never shown.Sun, 09 Aug 2026 00:00:00 GMTRESEARCH