About
I'm Riyaz Ahmed. I work on security engineering — the unglamorous parts: threat modelling, auth flows, dependency hygiene, and figuring out why something that should be safe isn't.
This site is where I write up what I learn. Posts tend to be one of three things: a walkthrough of a vulnerability or a class of bug, notes on a system I had to reverse, or a write-up of something I built and the trade-offs I hit.
What this site is
A static site. There is no database, no login, no comment system, no newsletter, and no analytics. Pages are Markdown files in a git repository, rendered to HTML at build time, and served from a CDN.
That is a deliberate choice, not a limitation. It means there is no admin panel to brute-force, no plugin to patch, no session to hijack, and no third-party script with read access to everything you type here. The attack surface is a folder of files.
Colophon
- Generator — Astro, output as fully static HTML
- Hosting — Cloudflare Pages
- Content — Markdown and MDX, versioned in git
- JavaScript — none shipped to the browser by default
- Fonts — self-hosted, no third-party font CDN
- Analytics — none