https://a2h.dev/writingWrite-ups by Abdullah Abdelrazek.enhttps://a2h.dev/writing/five-aws-line-items-behind-surprise-billshttps://a2h.dev/writing/five-aws-line-items-behind-surprise-billsThu, 15 Oct 2026 00:00:00 GMTNAT gateways, cross-AZ traffic, forgotten resources, CloudWatch logs and egress: where surprise AWS bills come from, and the 20 minutes of setup that catches them.https://a2h.dev/writing/least-privilege-limits-the-blast-radiushttps://a2h.dev/writing/least-privilege-limits-the-blast-radiusThu, 08 Oct 2026 00:00:00 GMTScoping access down is about what a stolen credential can reach, and that gets decided when you grant it.https://a2h.dev/writing/stop-sending-production-secrets-over-slackhttps://a2h.dev/writing/stop-sending-production-secrets-over-slackThu, 01 Oct 2026 00:00:00 GMTMost small teams hand out production secrets in chat. Moving them to one managed store takes an afternoon.https://a2h.dev/writing/hacking-hackerone-with-computer-visionhttps://a2h.dev/writing/hacking-hackerone-with-computer-visionThu, 11 May 2023 00:00:00 GMTI trained an object detection model to scan every video in HackerOne's disclosed reports for other reports that should have stayed private.https://a2h.dev/writing/the-easiest-2500-from-bug-bountyhttps://a2h.dev/writing/the-easiest-2500-from-bug-bountyFri, 05 Mar 2021 00:00:00 GMTMy first bug bounty: the Uber app showed a driver's real phone number when you chose to text them.https://a2h.dev/writing/how-i-hacked-ibmhttps://a2h.dev/writing/how-i-hacked-ibmTue, 15 Dec 2020 00:00:00 GMTAn exposed logs folder on an IBM server led to working tokens, cloud credentials and an admin login for internal DevOps tools.