{"version":"https://jsonfeed.org/version/1.1","title":"Louis Wright","home_page_url":"https://louiswright.co.uk","feed_url":"https://louiswright.co.uk/feed.json","description":"Cyber security researcher and software engineer based in the UK.","language":"en-GB","authors":[{"name":"Louis Wright","url":"https://louiswright.co.uk"}],"items":[{"id":"https://louiswright.co.uk/writing/broken-links-before-deploy","url":"https://louiswright.co.uk/writing/broken-links-before-deploy","title":"23% of News Pages Have a Broken Link. Catch Yours Before Deploy","content_text":"In May 2024, Pew Research Center reported that 23% of news webpages in its sample contained at least one broken link, and 21% of government webpages did too [1]. Across a decade of Common Crawl snapshots, a quarter of…","date_published":"2026-10-16T00:00:00Z"},{"id":"https://louiswright.co.uk/writing/captcha-free-form-protection","url":"https://louiswright.co.uk/writing/captcha-free-form-protection","title":"CAPTCHAs Lost to AkiraBot on 80,000 Sites. Here Is Captcha-Free Form Protection","content_text":"In April 2025, SentinelLABS published research on AkiraBot: an AI-powered spam framework that targeted more than 420,000 websites and successfully spammed at least 80,000 of them since September 2024 [1]. It used OpenAI…","date_published":"2026-10-15T00:00:00Z"},{"id":"https://louiswright.co.uk/writing/csp-headers-in-ci","url":"https://louiswright.co.uk/writing/csp-headers-in-ci","title":"81% of Sites Ship Without a CSP Header. Here Is How to Catch Yours in CI","content_text":"Here is a number that should bother anyone who ships websites: in the HTTP Archive's 2024 crawl, only 19% of hosts sent a Content-Security-Policy header [1]. Flip that around and roughly four out of five sites go live…","date_published":"2026-10-14T00:00:00Z"},{"id":"https://louiswright.co.uk/writing/pin-your-github-actions","url":"https://louiswright.co.uk/writing/pin-your-github-actions","title":"A Version Tag Leaked CI Secrets: Lessons From CVE-2025-30066 for Your GitHub Actions","content_text":"On March 14 and 15, 2025, the version tags of a popular GitHub Action stopped meaning what everyone thought they meant. A threat actor modified the tags v1 through v45.0.7 of tj-actions/changed-files so they pointed at…","date_published":"2026-10-14T00:00:00Z"},{"id":"https://louiswright.co.uk/writing/secrets-in-your-bundle","url":"https://louiswright.co.uk/writing/secrets-in-your-bundle","title":"Your .env Is Not Where Your Secrets End Up: Scanning the Bundle You Actually Ship","content_text":"In 2019, researchers at North Carolina State University went looking for API keys and private keys in public GitHub repositories. Their NDSS paper, \"How Bad Can It Git?\", found that secret leakage was pervasive,…","date_published":"2026-10-14T00:00:00Z"}]}