https://usus101.cybergalaxy.me/A slow blog about application security and the craft of shipping software.en https://usus101.cybergalaxy.me/posts/pinning-dependencies-is-not-optional-anymore.htmlhttps://usus101.cybergalaxy.me/posts/pinning-dependencies-is-not-optional-anymore.htmlTue, 11 Aug 2026 09:00:00 +0000There is no shortage of articles about Vault. Most of them cover the happy path. This one is about what happened after the happy path ended. https://usus101.cybergalaxy.me/posts/security-reviews-that-developers-don-t-dread.htmlhttps://usus101.cybergalaxy.me/posts/security-reviews-that-developers-don-t-dread.htmlWed, 22 Jul 2026 09:00:00 +0000There is no shortage of articles about Burp Suite. Most of them cover the happy path. This one is about what happened after the happy path ended. https://usus101.cybergalaxy.me/posts/threat-modeling-in-thirty-minutes.htmlhttps://usus101.cybergalaxy.me/posts/threat-modeling-in-thirty-minutes.htmlSun, 28 Jun 2026 09:00:00 +0000This post started as a note to my future self. Every few months I relearn the same lessons about threat modeling, so this time I'm writing them down. https://usus101.cybergalaxy.me/posts/signing-container-images-with-sigstore.htmlhttps://usus101.cybergalaxy.me/posts/signing-container-images-with-sigstore.htmlThu, 26 Mar 2026 09:00:00 +0000This post started as a note to my future self. Every few months I relearn the same lessons about least privilege, so this time I'm writing them down. https://usus101.cybergalaxy.me/posts/rotating-secrets-without-a-maintenance-window.htmlhttps://usus101.cybergalaxy.me/posts/rotating-secrets-without-a-maintenance-window.htmlMon, 02 Mar 2026 09:00:00 +0000For a long time I treated session management as something to worry about later. Then a small change to our Semgrep setup turned into a week of debugging, and "later" arrived all at once. https://usus101.cybergalaxy.me/posts/session-cookies-done-right.htmlhttps://usus101.cybergalaxy.me/posts/session-cookies-done-right.htmlThu, 25 Sep 2025 09:00:00 +0000There is no shortage of articles about Wireshark. Most of them cover the happy path. This one is about what happened after the happy path ended. https://usus101.cybergalaxy.me/posts/least-privilege-for-humans-not-just-services.htmlhttps://usus101.cybergalaxy.me/posts/least-privilege-for-humans-not-just-services.htmlTue, 09 Sep 2025 09:00:00 +0000I've been working with Burp Suite for about 3 years now, and my opinions on least privilege have changed more than I expected. https://usus101.cybergalaxy.me/posts/ssrf-explained-through-real-world-mistakes.htmlhttps://usus101.cybergalaxy.me/posts/ssrf-explained-through-real-world-mistakes.htmlThu, 15 May 2025 09:00:00 +0000This post started as a note to my future self. Every few months I relearn the same lessons about SSRF, so this time I'm writing them down. https://usus101.cybergalaxy.me/posts/what-a-leaked-api-key-taught-our-team.htmlhttps://usus101.cybergalaxy.me/posts/what-a-leaked-api-key-taught-our-team.htmlThu, 08 May 2025 09:00:00 +0000Every codebase has one area everyone is a little afraid to touch. On our team, it was everything related to supply chain security. https://usus101.cybergalaxy.me/posts/your-content-security-policy-is-probably-too-loose.htmlhttps://usus101.cybergalaxy.me/posts/your-content-security-policy-is-probably-too-loose.htmlSun, 04 May 2025 09:00:00 +0000Every codebase has one area everyone is a little afraid to touch. On our team, it was everything related to content security policy.