Blog — SecSmithOps

Research & Notes

Findings from the field

Short, practical write-ups on the vulnerability classes and misconfigurations we see most often — written for the engineers who have to fix them.

Broken object-level authorization rarely trips a signature-based scanner. Here's what a manual reviewer looks for instead.

Zero-days make headlines. In real engagements, an over-permissioned role or an open storage bucket gets us there first.

A findings list isn't a report. Here's how we structure ours so engineering teams can act on it the same day.