Personal site of Wahyudi — Software Engineer, SDET, Application Security engineer, and Security Researcher. Pentesting methodology, security writeups, and projects.https://wahyudi.dev/en-ushttps://wahyudi.dev/blog/subdomain-enumeration-deep-dive/https://wahyudi.dev/blog/subdomain-enumeration-deep-dive/A practical, ordered approach to subdomain discovery — from passive OSINT to active resolution, wildcard handling, and cleanup of false positives.Fri, 14 Aug 2026 00:00:00 GMThttps://wahyudi.dev/blog/api-security-testing-for-sdets/https://wahyudi.dev/blog/api-security-testing-for-sdets/How quality engineers can shift left on API security — threat-focused test cases, auth bypass checks, and automation patterns that don't burn the team's time.Wed, 22 Jul 2026 00:00:00 GMThttps://wahyudi.dev/blog/responsible-disclosure-playbook/https://wahyudi.dev/blog/responsible-disclosure-playbook/What happens between 'you found something' and 'the fix shipped' — triage, evidence, CVEs, timelines, and how to behave like a professional when vendors get busy.Wed, 03 Jun 2026 00:00:00 GMThttps://wahyudi.dev/blog/mobile-app-security-testing/https://wahyudi.dev/blog/mobile-app-security-testing/A reproducible Android/iOS testing workflow — static analysis, runtime instrumentation with Frida, traffic interception, and storage inspection.Sat, 18 Apr 2026 00:00:00 GMT