Author
Founder of Uphack · Senior Security Engineer at Amazon
I’m a senior security engineer at Amazon and a penetration tester specialising in web and API security. I came up through full-stack engineering and still write code daily. That background lets me bridge engineering and security: when I break something, I also understand how it was built and how to fix it so the issue does not return.
I have more than 15 years of experience in security. For the past six years, my full-time focus has been solving complex security problems at scale and finding high-impact vulnerabilities.
Most of my work is offensive: leading deep-dive penetration tests and investigating authentication flows, API design decisions, and cross-service trust boundaries. I care most about identifying the pattern behind a vulnerability, fixing its root cause, and putting defenses in place so entire classes of bugs stop recurring.
Outside my day-to-day work, I create hands-on security education through Uphack and build tools that automate parts of my penetration-testing methodology.
Through Uphack, I turn my knowledge into practical educational content that makes abstract security concepts easier to recognise in real systems. I write about how vulnerabilities emerge, how systems fail, and how engineers can build stronger security intuition through practice. I also share what I’m learning about software engineering in the AI era and the often-unspoken lessons behind a sustainable career in security.
WP2Shell is an unauthenticated remote code execution chain in WordPress core, combining CVE-2026-63030 and CVE-2026-60137. What it is, how to fix and detect it, and how to reproduce the full pre-auth RCE in a hands-on lab.
AI can now generate code, fixes, and explanations faster than most developers can properly evaluate them. That sounds like a productivity breakthrough. It may also be the fastest way to become a worse engineer without noticing.
AI makes it dramatically cheaper to produce software that appears to work. But 'building an app' and 'engineering a system' are two different activities that people keep confusing, and the gap between them is where most of the actual work lives.
Security is having a moment: new tools can read code, find bugs, and even suggest fixes. Some people took that to mean cybersecurity is basically over. This is my take from the inside: what’s actually changing, what isn’t, and why security was never just a code problem.
Is hacking like in the movies? How do I start? What do I need to know? What skills should I have? These are...
More posts
This post is all about the “big ideas” behind secure systems, like least privilege and separation of duties. These principles are surprisingly simple but form the backbone of how we design systems to stay safe from attacks.
How do systems make sure the right people get in, and the wrong ones stay out? In this post, we’ll dig into authentication (proving who you are) and authorization (what you’re allowed to do). They’re simple ideas, but they have a massive impact on security.
The CIA triad isn’t just a catchy acronym. It’s the backbone of security. We’ll break down confidentiality, integrity, and availability, and see how they shape the way we think about protecting systems and data.
We cannot start a meaningful exploration of computer security without defining the subject itself. In this post, we'll talk about what security actually means.