Blog | Diogo Pereira

Signed by Nobody: The BLS Identity Exploit That Drained $9M from Bonzo Lend

Posted on July 18, 2026

A ground-up explanation of how the BLS identity-element forgery let an attacker submit an unsigned price update to Supra's oracle and borrow $9M from Bonzo Lend. [Read More]
Tags:
- web3
- security
- hedera
- defi
- cryptography
Audited. Formally Verified. Totally Compromised. — Teams Domain, ETHDenver 2026

Posted on March 2, 2026

At this year’s EthDenver, I had the privilege of presenting a session titled “Audited. Formally Verified. Totally Compromised.” — and if you were there, you know time ran out before I could cover everything I wanted. [Read More]
Tags:
How a Simple Script Could Have Protected 23,000 Github Repositories — tj-actions/changed-files

Posted on March 26, 2025

Recently, a Supply Chain Attack targeted tj-actions/changed-files GitHub Action Repository, having potentially exploited around 23,000 repositories, with the intent of exfiltrating credentials —CVE-2025–30066. [Read More]
Tags:
What is PASETO and How Does it Compare to JWT?

Posted on March 4, 2025

JWT has long been the industry standard for token-based authentication, but PASETO offers safer cryptographic defaults. Here's what PASETO is, how it differs from JWT, and when to reach for it. [Read More]
Tags:
My Journey Through the CDP Certification by Practical DevSecOps

Posted on July 1, 2024

In the rapidly evolving world of software development, staying ahead of the curve is crucial. As security becomes an integral part of the development lifecycle, certifications like the Certified DevSecOps Professional (C [Read More]
Tags:
Securing Remote Operations feat. SSH-Agent

Posted on May 30, 2024

If you are someone who needs to configure or deploy code to different remote machines, you probably use SSH for the majority of your tasks… [Read More]
Tags:
- devops
- cybersecurity
- ssh
- deployment
- automation
Boost Your Development Productivity: Why Developers Should Master SSH Port Forwarding

Posted on February 19, 2024

In the realm of software development, efficiency is the name of the game. [Read More]
Tags:
My 50 cents on the OSWE Certification Exam

Posted on August 3, 2022

This is my personal review of the Offensive Security Web Expert Exam Certification (WEB-300 course) I accomplished on the 12/10/2021. [Read More]
Tags:

Signed by Nobody: The BLS Identity Exploit That Drained $9M from Bonzo Lend

Audited. Formally Verified. Totally Compromised. — Teams Domain, ETHDenver 2026

How a Simple Script Could Have Protected 23,000 Github Repositories — tj-actions/changed-files

What is PASETO and How Does it Compare to JWT?

My Journey Through the CDP Certification by Practical DevSecOps

Securing Remote Operations feat. SSH-Agent

Boost Your Development Productivity: Why Developers Should Master SSH Port Forwarding

My 50 cents on the OSWE Certification Exam