About
I am Mai Tan Loi. I built websites for years, got interested in how they break, and now spend most of my spare time on application security.
This site is where I write that down. Not a tutorial series and not news — it is closer to a lab notebook that happens to be public. If a post exists, it is because I worked through the thing myself and wanted a record I could come back to.
What is here
- Writeups — labs I solved, mostly PortSwigger Web Security Academy. Recon, the hypothesis I formed, the request that actually worked, and the root cause underneath it.
- Code review — reading source to find logic bugs, broken authorization and IDOR. Mostly Node.js and modern JavaScript stacks, because that is the code I know best.
- Vulnerabilities — one bug class at a time: root cause, variants, and what makes it exploitable in practice rather than in theory.
- Secure coding — the other direction. Patterns that make a bug hard to write in the first place, aimed at developers shipping web apps.
Certification status
I am working toward OSWE. I have not taken the exam and I am not certified. When that changes, this paragraph changes — until then, assume everything here is written by someone still learning.
How I write these
Writeups come from my own notes, written while the lab is still fresh. I do not reproduce the official solution — that would break the platform terms and it would also be pointless, since the original is a click away.
I do not invent case studies, numbers, or clients to make a point land harder. If I am unsure about something, the post says so. If I got it wrong on the first attempt, the post usually says that too, because the wrong turn is often the useful part.