/labs · 4 posts

Field notes.

Short pieces from the security work, cloud deploys, and AI product engineering I do day-to-day. Written in the order I learned them.

SSRF in modern serverless — the metadata path that won't die

Cloud SSRF mitigations keep getting reinvented. Here's a pattern for defending edge functions properly.

A workflow for treating preview URLs as production rehearsals, not throwaway links.

A line-by-line audit list for shipping Next.js apps that actually survive a pentest.

Hard-won notes on prompt design, latency budgets, and not letting the model lie to your users.