# Write-ups
Detailed, text-form deep dives - more depth than a Short has room for.
AI Prompt Injection Explained: How Untrusted Text Hijacks LLM Apps
A deep dive on prompt injection - why LLMs can't cleanly separate instructions from data, several worked examples (direct, indirect, and tool-exfiltration attacks), and why the fix looks more like defense-in-depth than a single patch.
Read write-up →
Broken Access Control: Why It's #1 on the OWASP Top 10
A deep dive on Broken Access Control, the top-ranked risk in the OWASP Top 10 2025 - the shapes it takes beyond IDOR, how it's tested for, and how to design against the whole category instead of patching one route at a time.
Read write-up →
IDOR: How Broken Object References Turn Into Account Takeover
A deep dive on Insecure Direct Object References - why they're so common, how they're found, and how to actually fix them, with real-world examples and a vulnerable-code walkthrough.
Read write-up →
SQL Injection: Why the Oldest Bug in the Book Still Pays
A deep dive on SQL injection - how string-built queries let attackers rewrite your database logic, a vulnerable-code walkthrough, and the parameterized-query fix that actually closes it.
Read write-up →
No write-ups match that filter yet.