Original, practical technical guides and methodologies authored by Singamsetti Poorna Mani Teja (SPM Teja) for security researchers, developers, and system architects.
VAPT & Offensive Security
Singamsetti Poorna Mani Teja (SPM Teja)•2026
Modern Web Application Penetration Testing Methodology: From Recon to Remediation
A systematic guide to evaluating modern single-page applications and microservice backends, transitioning from passive OSINT reconnaissance to deep manual logic exploitation and actionable developer remediation.
Core Architectural Takeaways
Why passive DNS and Certificate Transparency inspection reveal forgotten staging subdomains before active scanning begins.
How Broken Object Level Authorization (BOLA) consistently evades automated DAST tools and requires contextual session manipulation.
Structuring CVSS v3.1 severity scores alongside reproducible curl Proof-of-Concepts (PoCs) to accelerate dev remediation.
API Defense & Backend Security
Singamsetti Poorna Mani Teja (SPM Teja)•2026
Securing REST APIs in Python FastAPI and Node.js: Authentication, Rate Limiting & Input Validation
Concrete implementation blueprints for hardening asynchronous REST endpoints against mass assignment, token replay attacks, brute-force enumeration, and injection vulnerabilities.
Core Architectural Takeaways
Strict Pydantic schema validation preventing mass assignment vulnerabilities in Python FastAPI.
Cryptographic JWT signing using asymmetric RS256 keys rather than shared HS256 secrets.
Token-bucket rate limiting at the reverse proxy and application layer to mitigate automated credential stuffing.
Application Security & React
Singamsetti Poorna Mani Teja (SPM Teja)•2026
Defensive Frontend Engineering: Protecting Modern React Applications Against Client-Side Attacks
Engineering defensible React architectures by isolating user tokens, eliminating Cross-Site Scripting (XSS) vectors, enforcing strict Content Security Policies, and preventing state injection.
Core Architectural Takeaways
Why authentication tokens should never reside in localStorage and must be isolated in HttpOnly, SameSite=Strict cookies.
Defending against DOM-based XSS when utilizing dynamic HTML rendering or third-party Markdown libraries with DOMPurify.
Configuring automated Content Security Policy (CSP) headers that disallow unsafe-inline scripts while preserving hydration.
Looking for AI-readable documentation?
Access structured llms.txt specifications and machine-friendly documentation indexes.