Security
5 posts
Security research, incidents, and practical lessons. If you need a security review for your product, see my security audits.
Cloudflare's trust is the vulnerability
Two unrelated abuse cases - pirated video hidden as .woff2 fonts, and phishing pages hosted on r2.dev - share the same root cause: attackers exploiting inherited trust rather than breaking anything.
Your WooCommerce AI Chatbot Might Be Your Biggest Liability
ChatGPT wrapper plugins in WooCommerce stores have no guardrails for e-commerce context. Wrong prices, wrong policies, and hallucinations aren't just UX problems.
Why WooCommerce Stores Have 3 Attribute Plugins Doing the Same Job - and Why That's a Security Problem
Plugin redundancy in WooCommerce isn't just technical debt - it actively expands your attack surface. Here's how it happens and what to do about it.
WooCommerce Security Audit: The 12 Things I Check Before Anything Else
A practical checklist of the first things I look at when auditing a WooCommerce store for security issues - from plugin bloat to exposed debug info.
SOC 2: Lessons Learned from My Duck-ups
SOC 2 compliance isn't something you do once and forget - it's an ongoing quarterly effort. Here's what I learned the hard way.