https://theakash.eu.cc/blog Security writeups and engineering notes — offensive security, AppSec, and AI. en Sat, 18 Jul 2026 00:55:58 GMT https://theakash.eu.cc/blog/hardening-http-security-headers https://theakash.eu.cc/blog/hardening-http-security-headers Mon, 18 May 2026 00:00:00 GMT AppSec A practical, header-by-header walkthrough of turning a leaky default web response into a locked-down A+ — with copy-paste config and the reasoning behind each directive. https://theakash.eu.cc/blog/owasp-top-10-by-exploitation https://theakash.eu.cc/blog/owasp-top-10-by-exploitation Thu, 02 Apr 2026 00:00:00 GMT Offensive Security The OWASP Top 10 sticks better when you see how each category actually gets exploited. A field guide from the attacker's chair — and the fix from the defender's. https://theakash.eu.cc/blog/ai-triage-layer-for-soc https://theakash.eu.cc/blog/ai-triage-layer-for-soc Wed, 11 Feb 2026 00:00:00 GMT AI + Security Alert fatigue is a data problem, not a staffing one. How I designed an LLM-assisted triage layer that ranks, clusters, and explains security alerts — without letting the model make security decisions.