Notes on security, code, and other things I find interesting.

Here you can find some of the things I find interesting and some of the things I've been working on.

February 18, 20255 min read

How RCE Works - and How I Found One in IriusRisk's Drools Engine

A technical walkthrough of remote code execution, why rule engines are dangerous attack surfaces, and how a custom Drools rules menu became a Java code injection vector.

security rce vulnerability-research drools

January 28, 20252 min read

Threat Modeling in Practice: From Theory to Production

How structured threat modeling turns security standards into actionable design decisions - without slowing teams down.

security threat-modeling sdlc

January 5, 20252 min read

Hi! I'm Álvaro

A brief introduction about myself and the content that you may find here.

personal life welcome