Blog

• 2026-07-29 Treat your chatbot's replies as untrusted input

  Ask a language model to reply with an HTML tag and it usually will. If your chat widget puts that reply into innerHTML, you have built a cross-site scripting vector where the payload is laundered through a model — and where the person who supplied it never touched your markup directly. This lab builds the front end that doesn't do that, with an AI disclosure that holds up when someone tells the bot to deny it.

  #llm-security #prompt-injection #eu-ai-act #xss #csp
• 2026-07-27 Put a chatbot on your site without handing out your API key

  Adding a chatbot to a personal site takes about twenty lines of JavaScript. Most tutorials that show you those twenty lines are handing your API key to every visitor who opens DevTools. Fixing that turns a credential problem into a spending problem, because the endpoint you build to hold the key is one a stranger can call all day. This lab solves both, on shared hosting, for free.

  #llm-security #api-keys #rate-limiting #php #threat-modelling
• 2026-06-28 Analysing email headers with Python: a hands-on CSIRT lab

  Every phishing email that lands in someone's inbox leaves a paper trail

  In this lab you will parse a real-looking phishing .eml file using nothing but Pytho...

  #Python
• 2026-06-28 What Is AI, Really? Notes on Getting the Vocabulary Straight

  These are my notes from working through the fundamentals of AI cleaned up enough to be readable, but written the way I think about the material rather than the...

• 2026-06-28 AWS S3 Security Lab: Exploiting and Fixing Bucket Misconfigurations

  These are my notes from an AWS S3 Security Lab that simulates a common cloud misconfiguration. The lab involves playing three roles: the developer who makes a m...

  #AWS #AWS Security
• 2026-06-28 Why Understanding Threat Intelligence is Key to Cyber Security

  In our increasingly connected world, cybersecurity is no longer just about firewalls and antivirus software. It's about staying one step ahead of a constantly e...

• 2026-06-28 S3 Security Lab Notes: IP Lock

  This lab demonstrates how to create a public S3 bucket and apply IP-based policies to restrict access to specific IP address ranges. This simulates a common rea...

  #AWS #AWS Security
• 2026-06-28 Python for AI - First Steps with Data

  My notes from getting comfortable with the Python data stack. The goal wasn't to memorise the API surface of pandas or numpy - it was to reach the point where ...

• 2026-06-28 Building My First Pwnagotchi: A Beginner's Journey into Wireless Security

  Pwnagotchi is an AI-powered device inspired by the 1990s Tamagotchi digital pet. However, instead of feeding a virtual creature, this portable, battery-powered...

• 2026-06-28 SQL for security analysts: log analysis from zero to detection

  If you can read a CloudTrail log, you already understand the data model. SQL just gives you a faster, repeatable way to ask questions of it — and a language for...