The UnboundCompute blog

Writing on web security

Blind SSRF: Exploiting Requests You Cannot See

With blind ssrf, a server makes attacker controlled requests you never see. Learn how it differs from classic SSRF, why it is…
Second Order SQL Injection: The Payload That Waits

Second order SQL injection stores a payload safely, then your own code reads it back into a query and runs it. Learn…
Stalkerware: How to Detect Hidden Phone Spying and Remove It

Stalkerware hides on your phone and reports your messages and location. Learn the warning signs, how to check iPhone and Android, and…
Passkeys vs Passwords: What Actually Changes for Your Security

Passkeys vs passwords, explained simply. See why phishing, reuse, and credential stuffing fail, plus the honest tradeoffs before you switch.
Quishing Explained: How QR Code Phishing Works and How to Spot It

Quishing is QR code phishing that hides bad links in a square code. Learn how the scam works and how to check…
Juice Jacking: Can a Public USB Port Really Steal Your Data?

Can a public USB port steal your data? Here is how juice jacking works, whether the risk is real today, and the…
SIM Swapping: How Attackers Hijack Your Phone Number

Sim swapping lets attackers steal your phone number and hijack your accounts. Learn the warning signs and the steps that stop it…
The Fine Tuning Jailbreak: How Training Strips Safety Alignment

A fine tuning jailbreak strips a model’s safety with a few training examples. How the attack works, why alignment is fragile, and…
Insecure Output Handling: When Apps Trust the Model’s Words

Insecure output handling is the OWASP LLM bug where apps trust model text into a browser, shell, or database. See how it…
Excessive Agency in AI Agents: The Risk That Turns a Trick Into a Breach

Excessive agency is why a small prompt injection becomes a real breach. Learn its three parts, how to spot it, and how…