iamyi.net
iamyi.net is my personal profile site and a collection of my personal writings about security.
The content here is primarily focused on application security, cloud security, GenAI and ML security, security architecture, and related research notes.
Latest writing
Updated at July 16, 2026, 4:54 PM
| Writing | Keywords | Summary |
|---|---|---|
| Review JWT Implementation | security code review, jwt implementation, rs256, jwks, refresh token rotation | How to review secure JWT issuance and validation—RS256 signing, JWKS publication, key rotation, and refresh token rotation beyond basic parse flaws. |
| Review SAML Federation | security code review, saml, assertion signature, acs url, replay attack, metadata trust | How to review SAML federation code for assertion signature validation, ACS URL binding, replay prevention, and metadata trust. |
| Review Secure Implementations | security code review, OAuth, OpenID Connect, JWT, TLS, identity | Overview of reviewing secure implementations for OAuth, OIDC, JWT, TLS, and related identity and transport controls. |
| Human-in-the-Loop AI Review — Prevent Shallow Reports | security code review, AI-assisted review, human in the loop, validation, shallow findings, bug bounty triage | How to keep AI-assisted security review evidence-driven—separate leads from validated findings, prove exploitability, and avoid polished but unproven reports. |
| Review Reflected XSS | security code review, reflected xss, cross-site scripting, output encoding, search pages | How to read code for reflected cross-site scripting—trace request input echoed in the immediate HTML response and verify context-appropriate encoding. |
| Review DOM XSS | security code review, dom xss, cross-site scripting, innerHTML, client-side xss | How to read code for DOM-based cross-site scripting—trace browser-controlled sources into dangerous DOM and JavaScript sinks without server-side reflection. |
| Review SQL Injection | security code review, sql injection, prepared statements, parameterized queries, CWE-89 | How to read code for SQL injection—trace attacker-controlled input into database calls and verify values are bound as data, not appended as syntax. |
| Review Command Injection | security code review, command injection, os command injection, shell injection, CWE-78 | How to read code for command injection—trace attacker-controlled input into process-spawning APIs and verify arguments are allowlisted or passed without a shell. |
| Review Code Injection | security code review, code injection, expression injection, script engine, eval | How to read code for code injection—trace attacker-controlled input into evaluators and verify user data is never executed as application code. |
| Review JSON Injection | security code review, json injection, json parsing, prototype pollution, input validation | How to read code for JSON injection—trace attacker-controlled data into JSON construction or object merges and verify schema enforcement server-side. |
Browse by section
| Section | What you will find |
|---|---|
| Whoami | Short profile and how to interpret this site. |
| Topics → GenAI & ML security | Longer, theme-led notes (starting with framing secure GenAI/ML). |
| Security musings | Essays and notes on security engineering practice and role. |
| Incidents & trends | Timely analysis of reports, breaches, and technical shifts. |
License
Unless otherwise noted, the original writing in this repository is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).
See https://creativecommons.org/licenses/by/4.0/ for the license terms.