Samuel Mortenson's personal blog

I recently launched SevHunt, an Internal Bug Bounty platform, and wanted to talk a bit about how you can use it to incentivize your employees to find and report security bugs to your team.

As a part of building AwaySync, I’ve been doing a lot of research into collaborative editing.

If you maintain a web application and like to test locally, you probably have some amount of fake data (stuff that mimics your real production database).

For the last four years I’ve been working on a static site generator for Drupal called Tome.

During quarantine I decided to start playing music again, and entered the world of synthesizers, "DAWless" setups, and inevitably MIDI.

Why do content management systems have backends?

After a few weeks of mulling, I've decided to start doing more of my work in private, and drop most of my obligations with open source projects I maintain or contribute to.

I've just published a new project for performing static application security testing (SAST) on Drupal sites, mortenson/psalm-plugin-drupal.

I’ve done quite a bit of security research for Drupal, and one area of exploitation that I often come back to is the AJAX API.

Drupal doesn’t have many SQL injection vulnerabilities anymore, at least not since the original Drupalgeddon was released into the wild.

There’s a feature in Drupal that not a lot of people know about, but is a great target for security research - private files.

Recently I’ve started to pick up a new programming language, Go, but have struggled to absorb lessons from presentations and tutorials into practical knowledge.

I've just finished re-building my site using Tome and Single File Components (SFC), two Drupal projects I maintain and wanted to test out on a real site.

I’ve been thinking about ways to make Drupal frontend easier recently, and have been working on an experimental module called Single File Components (SFC), which lets you put your CSS, JS, Twig, and PHP in one file.

As a part of my ongoing work on Tome, a Drupal static site generator, I’ve become interested in providing a solution for static searches.

Six months ago I started work on Tome, a static site generator for Drupal 8.

Note: This exploit was fixed over a year ago as a part of SA-CORE-2017-002/CVE-2017-6919, so unless your Drupal 8 site is really, really out of date, you should not be affected.

I recently celebrated my five-year anniversary on Drupal.org, and wanted to write about how I work on issues day-to-day and my general contribution “vibe”.

Last week I published the Twig Components Drupal module - the latest in a series of projects aiming to combine Twig, Web Components, and PHP.

In the world of web security, cross-site scripting (XSS) vulnerabilities are extremely common, and will continue to be a problem as web applications become increasingly complex.

Note: The exploit discussed in this post was never included in a stable core release, so don’t freak out!