bruno menna https://menna.website/ 2026-08-13T00:00:00.000Z bruno menna fetch() silently drops your ssrf agent https://menna.website/posts/fetch-agent/ 2026-08-13T00:00:00.000Z you wired an ssrf guard in as the http agent, tested it, shipped. but node's global fetch() silently ignores the agent option, so the filter never runs. why it happens, and the fix that actually works. 127.0.0.1 never touches your resolver (node + rust) https://menna.website/posts/resolver-skip/ 2026-08-13T00:00:00.000Z hook the dns layer to block internal addresses and it feels airtight — every request resolves. except ip literals skip resolution entirely, so your resolver-based guard never runs. the same root cause in node's undici and rust's reqwest, with runnable repros. does your ssrf guard resolve dns, or just regex the string? https://menna.website/posts/ssrf-libs/ 2026-08-13T00:00:00.000Z most ssrf guards just regex the hostname string. i threw a corpus of internal addresses at the popular npm libraries, then showed the two things a string check can never catch: dns resolution, and kubernetes search-domain expansion that turns a bare label into an internal service. how every language handles ipv4-mapped ipv6 differently (and why your ssrf protection doesn't work) https://menna.website/posts/ipv4mapped/ 2026-04-21T00:00:00.000Z i've reported 5 SSRF bypass CVEs in major open-source projects — librechat (35k stars), twenty crm (44k stars), stirling-pdf (77k stars), flowise (47k star the first 30 minutes on a new target https://menna.website/posts/first30/ 2026-04-13T00:00:00.000Z when i open a new program, i don't start running tools. i start understanding what the app does. reverse engineering android apps with jadx + frida https://menna.website/posts/jadx/ 2026-04-10T00:00:00.000Z most android apps trust the client way too much. hidden endpoints, hardcoded keys, debug flags left in production. all you need is the right toolchain to f finding idors at scale https://menna.website/posts/idor/ 2026-04-03T00:00:00.000Z idor — insecure direct object reference. it's been on the owasp top 10 for years and it's still everywhere. the concept is almost embarrassingly simple: ch broken access control in webhook implementations https://menna.website/posts/webhooks/ 2026-03-15T00:00:00.000Z webhooks are one of the most overlooked features in web apps. they're usually built late in the development cycle, bolted onto an existing api, and rarely mitmproxy setup for mobile interception https://menna.website/posts/mitmproxy/ 2026-03-01T00:00:00.000Z intercepting mobile app traffic is the first step in any mobile bug bounty engagement. mitmproxy is my go-to — it's free, scriptable, and works on both and