Web application security: vulnerability deep dives, testing notes and book reviews.https://www.jackmason.com/https://www.jackmason.com/blog/vibe-coding-hidden-security-risks/https://www.jackmason.com/blog/vibe-coding-hidden-security-risks/An exploration of the security risks that emerge when using AI coding agents to build full-stack applications.Wed, 21 Jan 2026 00:00:00 GMThttps://www.jackmason.com/blog/book-review-web-hackers-handbook/https://www.jackmason.com/blog/book-review-web-hackers-handbook/A review of The Web Application Hacker's Handbook - the 800-page classic that shaped web security testing methodology.Wed, 21 Jan 2026 00:00:00 GMThttps://www.jackmason.com/blog/burpsuite-active-scanner-xss-downfalls/https://www.jackmason.com/blog/burpsuite-active-scanner-xss-downfalls/An exploration of the limitations of Burp Suite's Active Scanner for XSS, and how to close the gap with manual testing.Wed, 21 Jan 2026 00:00:00 GMThttps://www.jackmason.com/blog/book-review-bug-bounty-bootcamp/https://www.jackmason.com/blog/book-review-bug-bounty-bootcamp/A review of Vickie Li's Bug Bounty Bootcamp - a fantastic introduction to web testing for bug hunters and penetration testers alike.Wed, 21 Jan 2026 00:00:00 GMThttps://www.jackmason.com/blog/a-deep-dive-into-client-side-prototype-pollution/https://www.jackmason.com/blog/a-deep-dive-into-client-side-prototype-pollution/A deep dive into Client-Side Prototype Pollution, how to detect it, and how to remediate it.Tue, 16 Sep 2025 00:00:00 GMThttps://www.jackmason.com/blog/the-dangers-of-unspecified-origins-postmessage/https://www.jackmason.com/blog/the-dangers-of-unspecified-origins-postmessage/A deep dive into the postMessage API, its vulnerabilities, and how to use it securely.Sun, 07 Sep 2025 00:00:00 GMThttps://www.jackmason.com/blog/a-methodical-approach-to-xss/https://www.jackmason.com/blog/a-methodical-approach-to-xss/A structured methodology for testing web applications for Cross-Site Scripting (XSS).Sat, 06 Sep 2025 00:00:00 GMThttps://www.jackmason.com/blog/understanding-algorithm-confusion-attacks/https://www.jackmason.com/blog/understanding-algorithm-confusion-attacks/A deep dive into JWT Algorithm Confusion Attacks, explaining how they work and how to prevent them.Tue, 02 Sep 2025 00:00:00 GMThttps://www.jackmason.com/blog/building-labs-with-google-gemini/https://www.jackmason.com/blog/building-labs-with-google-gemini/A tutorial on how to quickly build web app labs using docker and google gemini's CLI tool.Tue, 19 Aug 2025 00:00:00 GMThttps://www.jackmason.com/blog/untangling-https-virtual-hosting/https://www.jackmason.com/blog/untangling-https-virtual-hosting/A deep dive into the web application infrastructure.Sat, 16 Aug 2025 00:00:00 GMThttps://www.jackmason.com/blog/my-first-blog-post/https://www.jackmason.com/blog/my-first-blog-post/Why am I writing a blog and what will it be about?Sat, 09 Aug 2025 00:00:00 GMT