Blog

Security notes & build logs

Things I learn while hardening systems, hunting vulnerabilities and shipping software — written up so they're useful beyond my own notes.

Role-based access control sounds simple until you have multi-tenant data, sensitive documents, and five modules that all have to agree.

Why a generic model was not enough for Polish-language fraud, and how the alert flow protects the people most often targeted.