Independent learning journal

Application security.
In theory & practice.

I'm Kiefer Land. This is where I document the fundamentals, work through security labs, and deepen my understanding of AppSec.

Browse the field notes
Pixel-art architecture and an illuminated pathway beneath the title Application Security in Theory and Practice, by Kiefer Land.
Application security field notesPWPA preparation · Fundamentals in practice

Latest writing

9 ENTRIES
4 min readBroken Access Control: Checking Who Can Do WhatPWPA study notes on OWASP A01:2025, including authorization, record ownership, and why access checks belong on the server.3 min readStarting with the OWASP Top 10:2025My PWPA study notes on the OWASP Top 10:2025, its main changes, and the questions behind the first four risk categories.2 min readStarting Practical Bug Bounty: Web Application Security FoundationsNotes from my first Practical Bug Bounty study session: the course outline, why web security matters, and security best practices for PWPA preparation.3 min readPractice Log 06: Checking Access with Unpredictable IDsA practice journal on unpredictable account IDs, server-side authorization, and keeping findings within the evidence.2 min readPractice Log 05: Inspecting the Full ResponseA practice journal on horizontal access control, inspecting response bodies, and separating observations from assumptions.2 min readPractice Log 04: Profile Editing and PermissionsA practice journal on the boundary between ordinary profile editing and privileged permission changes.2 min readPractice Log 03: Client-Controlled Roles and Server-Side PermissionA short practice journal on client-controlled role data, server-side authorization, and comparing request edits with browser state.1 min readPractice Log 02: Access Control Beyond a Hidden URLAn unpredictable URL can hide functionality. It cannot decide who is allowed to use it.1 min readPractice Log 01: Access ControlAuthentication establishes identity. Authorization decides what that identity can do. A practice log on testing the boundary.

Behind the notes

Learning in public.
Testing in practice.

I'm preparing for the Practical Web Pentest Associate (PWPA). Alongside my certifications, education, and experience, I’m making space to practice the fundamentals—and share the work with others learning cybersecurity.

More about me Follow the journal

Building something that needs a second look?

I also review AI-built SaaS for access-control and data-exposure risks.

Explore consulting