Eight tracks

What is this handing to an interpreter?

A query built by joining strings, a command built the same way, and the parameterised forms that make both defects impossible rather than unlikely.

• A query built from stringsWhy concatenation loses, and why a bound parameter cannot.12 min
• Proving it, rather than suspecting itWhat counts as evidence, and why a longer response is not it.9 min
• Arguments, and command linesThe word-splitting step that turns a value into a flag.9 min
• The database is not a source of trustSecond-order injection: a value stored safely and used unsafely.10 min

Where do these bytes actually end up?

The four contexts a value can land in, why one escaper cannot serve all of them, and why sanitising on the way in is the wrong layer.

• One value, four contextsWhy a single escaping function is the wrong shape for the problem.14 min
• Stored and reflectedThe same defect, with the distance between the input and the damage changed.10 min
• Inside a script blockThe one context where HTML escaping does nothing at all.9 min

Who does this think you are, and why?

Cookies and their flags, fixation, tokens that verify the wrong thing, and the two responses that should be identical and are not.

• The cookie and its flagsThree attributes, three different doors.9 min
• The id that survived the loginSession fixation, and why rotation is the whole fix.11 min
• Two answers that should have been oneUser enumeration, and the helpfulness that costs more than it gives.8 min
• What a token says about itselfAlgorithm confusion, weak keys, and an expiry nobody reads.15 min
• How many tries do they get?Rate limits, and reset tokens that anybody can derive.10 min

Is this asking whether you may, or only who you are?

Object references, roles, forged requests and bodies written wholesale — the class of defect no scanner finds and no test suite catches.

• Who you are is not what you mayThe two checks that look like one, and the one that is usually missing.13 min
• The whole bodyMass assignment: the fields nobody meant to expose.8 min
• The cookie is not consentCross-site request forgery, and what a token bound to the session adds.11 min

Which file does this path actually name?

Joining, normalising, and the order those two happen in. Uploads, content types, and the resolver that checked a different path than it read.

• Which file does this path name?Joining, normalising, and the order those two happen in.12 min
• Serving back what you were uploadedContent types, and who gets to choose them.8 min

Where is this request going, and who chose?

The server as a confused deputy: fetching what it was told to, redirecting where it was pointed, and why deny-lists lose.

• The confused deputyWhy fetching a URL somebody handed you is not the same as them fetching it.13 min
• Where does this redirect go?Open redirects, and the three ways a leading slash is not enough.8 min

What is this telling you that it should not?

Serialising a whole record, logging a whole request, and the error page that is a reconnaissance tool.

• Serialising the whole recordThe column list is not a style preference.7 min
• Logging the requestWhere a credential outlives the request that carried it.7 min

Clean, commented, tested — and wrong where?

The thesis track. A handler a model produced: idiomatic, well named, plausibly commented, green suite, and wrong in one specific place. Find it, name it, prove it, fix it.