Field Notes
Blog & Writeups
Security writeups and engineering notes — offensive security, AppSec, and building secure, intelligent systems. Practical, hands-on, no fluff.
AppSec·May 18, 2026· 2 min read
Hardening HTTP Security Headers: From F to A+
A practical, header-by-header walkthrough of turning a leaky default web response into a locked-down A+ — with copy-paste config and the reasoning behind each directive.
Web SecurityOWASPHeadersNext.js
Offensive Security·Apr 2, 2026· 2 min read
The OWASP Top 10, Explained by Exploitation
The OWASP Top 10 sticks better when you see how each category actually gets exploited. A field guide from the attacker's chair — and the fix from the defender's.
OWASPPenetration TestingAppSecEthical Hacking
AI + Security·Feb 11, 2026· 2 min read
Building an AI Triage Layer for a SOC
Alert fatigue is a data problem, not a staffing one. How I designed an LLM-assisted triage layer that ranks, clusters, and explains security alerts — without letting the model make security decisions.
AILLMSOCThreat DetectionRAG