Backend developer & security researcher. Technical notes on backend systems, security research, and whatever I'm building.https://bytay.dev/enhttps://bytay.dev/blog/how-bad-authorization-design-put-200k-students-at-risk/https://bytay.dev/blog/how-bad-authorization-design-put-200k-students-at-risk/How I discovered a chain of IDORs in a public education platform used by every FP student in Catalonia, chained them into a full account takeover, and reported it responsibly.Sat, 16 May 2026 00:00:00 GMTsecurityidorweb-securityresponsible-disclosurehttps://bytay.dev/blog/python-toolchain-uv-ruff-ty/https://bytay.dev/blog/python-toolchain-uv-ruff-ty/Why I replaced pip, black, flake8, and mypy with a single stack from Astral, and how I integrate it in CI/CD with GitHub Actions.Tue, 12 May 2026 00:00:00 GMTpythontoolingdevopsbenchmarkshttps://bytay.dev/blog/how-i-structure-fastapi-projects/https://bytay.dev/blog/how-i-structure-fastapi-projects/What most FastAPI tutorials skip: how I structure routes, services, exceptions, logging, and multi-tenancy in a production B2B SaaS, and the reasoning behind each decision.Tue, 05 May 2026 00:00:00 GMTfastapiarchitecturepython