Security is often treated as something that happens after software is built. Developers build applications. Security professionals test them. Vulnerabilities are discovered, reported, patched and hopefully they are gone, at least, we hope so.

But, why do we need to wait until the end?

What if security was not a separate phase of software development? What if it was part of the development cycle from the very beginning?

And, there’s another side to this equation.

What if security professionals understood the technologies they assess with the same depth as the engineers who build them? What if understanding a technology went beyond knowing which tools to run, which ports to enumerate, or which vulnerabilities to exploit?

The objectives should not just be to identify what can be exploited. It should be to understand the technology, its purpose, implementation and engineering decisions behind it.

That understanding should work both ways. A security professional need to understand how software is actually designed, developed, deployed and maintained and the developers need to think about how their software can abused.

In short, software development and security shouldn’t operate in isolation. They should continuously make informed decisions about their approaches; and be able to answer how and why behind their decisions.

That’s the idea behind Pwn Security.

TL;DR: Developers should think like security professionals, and security professionals should think like software engineers. Understand not just how to build or break software, but also the how and why behind the technologies and decisions that shape it. That’s the gap Pwn Security aims to bridge.

Important Note: My Journey and experiences; not an Encyclopedia

Pwn Security is a personal space where I document my journey and past experiences in software development and ethical hacking. I aim to make these experiences useful to developers looking to adopt secure coding practices and/or security enthusiasts seeking to understand the deeper workings of protocols, services, and the technologies they encounter.

This isn’t an encyclopedia of cybersecurity knowledge. It’s a reflection of what I’ve learned, explored, built, broken, and discovered along the way.