#security

1. 
   aws

   How a CloudFront Custom Error Page Leaked JWTs to S3: A Case Study

   A pen-test curl found CloudFront forwarding `Authorization` headers to the S3 error-page bucket, where S3 reflected every JWT back in its XML error response. Two lines of Terraform closed it across sixteen distributions.

   NH Nedim Hadzimahmutovic Aug 13, 2026 · 12 min
2. 
   jwt

   How a JWT Audience Map Saved a CORS Mistake: A Defense-in-Depth Case Study

   On a client's API, a CORS wildcard looked like a HIGH severity finding — until we tried to actually exploit it. A second, independent JWT audience check turned a trivially exploitable bug into one that required a much harder prerequisite.

   NH Nedim Hadzimahmutovic Jul 22, 2026 · 7 min
3. 
   devsecops

   From DevOps to DevSecOps: How I Became Clearview's In-House Pen-Tester

   How we built an in-sprint pen-tester role into every engagement — the DevSecOps handoff, the two decades of DevOps that led to it, and the OWASP Top 10 categories that show up first in real client APIs.

   NH Nedim Hadzimahmutovic Jul 11, 2026 · 11 min

No essays match that search.