JavaScript Libraries and Browser APIs Worth Knowing for Security (2025)
End-of-year post. This one is a roundup of JavaScript libraries and browser APIs that I’ve found interesting from a security angle in 2025 — either because they’re useful for offensive tooling, because they’re misunderstood in ways that create vulnerabilities, or because they expose attack surface that defenders miss. Not a “top 10” list with scores. Just ..
Read moreClient-Side Hacking Curiosities (2025 edition)
Been accumulating a list of client-side weirdness all year. Things that surprised me, techniques I found while reading specs, and browser behaviours that look benign on paper but get interesting when you think adversarially. No particular order, no particular coherence — just a dump of things worth knowing if you spend time attacking or defending browser e..
Read more