diff --git a/20260111204228-rss_articles.org b/20260111204228-rss_articles.org
new file mode 100755
index 0000000..b714dfe
--- /dev/null
+++ b/20260111204228-rss_articles.org
@@ -0,0 +1,7 @@
+* [[https://world.hey.com/dhh/a-petabyte-worth-of-omarchy-in-a-month-a1fc538e][A petabyte worth of Omarchy in a month]]
+ :PROPERTIES:
+ :FEED: David Heinemeier Hansson
+ :MINIFLUX_ID: 6150
+ :READ_AT: 2026-05-28 18:01
+ :END:
+
diff --git a/20260421100223-dailies.org b/20260421100223-dailies.org
index e460475..ebe5e77 100755
--- a/20260421100223-dailies.org
+++ b/20260421100223-dailies.org
@@ -18,3 +18,8 @@ All daily journal entries, linked automatically.
** [[file:daily/2026-05-06.org][2026-05-06]]
** [[file:daily/2026-05-12.org][2026-05-12]]
** [[file:daily/2026-05-13.org][2026-05-13]]
+** [[file:daily/2026-05-20.org][2026-05-20]]
+** [[file:daily/2026-05-21.org][2026-05-21]]
+** [[file:daily/2026-05-22.org][2026-05-22]]
+** [[file:daily/2026-05-28.org][2026-05-28]]
+** [[file:daily/2026-05-29.org][2026-05-29]]
diff --git a/20260527152602-microlise_xss_rom_pentest.org b/20260527152602-microlise_xss_rom_pentest.org
new file mode 100755
index 0000000..10a4bb1
--- /dev/null
+++ b/20260527152602-microlise_xss_rom_pentest.org
@@ -0,0 +1,438 @@
+:PROPERTIES:
+:ID: b2ac09aa-e888-48d3-8357-2292f9b2526c
+:END:
+#+title: XSS Pentesting Report Fix
+#+filetags: :microlise:security:notes:
+
+* Metadata
+
+- Name :: Understanding Session XSS
+- Overview :: Pages 33–34 document an informational “Session stored XSS” finding on the TMC Schedule Execution Board. The issue is real (unescaped user input in a JavaScript context) but impact is limited because only the submitting user’s session is affected—classic self-XSS, not cross-user attack.
+
+** Todos
+
+- [X] review-finding :: Read pages 33–34 and map finding to SaveSearchCriteriaToSession + ScheduleExecutionBoard.aspx flow
+- [X] locate-source :: Open TMC Web Portal repo and find session save + inline script render for date/orderID/time
+- [ ] remediate-encode :: Apply HttpUtility.JavaScriptStringEncode to all session values in SetupControls() (~1849-1879)
+- [ ] remediate-validate :: Add server-side validation in SaveSearchCriteriaToSession before writing SEBSessionState
+- [ ] remediate-retest :: Retest with direct POST payload + normal UI search flow on ScheduleExecutionBoard
+
+* Understanding the Session Stored XSS Finding (Pages 33–34)
+
+** Where this sits in the report
+
+The [[file:d:/_dev/_misc/Pentest-04-26/Microlise TMC PO WA April 2026 v1.0.pdf][Microlise TMC PO WA April 2026 v1.0.pdf]] lists *14 findings* total. Pages 33–34 ([[file:d:/_dev/_misc/Pentest-04-26/33-34.pdf][33-34.pdf]]) are the last technical finding before “END OF DOCUMENT”:
+
+| Field | Value |
+|-------------+-----------------------------------------------------------------------|
+| Title | *Session stored XSS* |
+| Severity | *Informational* (lowest tier; 4 informational findings in the report) |
+| Status | Open |
+| CWE | [[https://cwe.mitre.org/data/definitions/79.html][CWE-79]] — Improper Neutralization of Input |
+| Environment | =cert.microlise.com= (cert/UAT), path prefix =/PENTEST/TMCWebPortal/= |
+
+Higher-severity items in the same report (SQLi, IDOR, BFLA, etc.) are separate; this finding is documented as *technically valid but low business risk*.
+
+-----
+
+** What XSS is (general)
+
+*Cross-Site Scripting (XSS)* means untrusted data ends up in a web page in a way the *browser treats as executable JavaScript*, instead of inert text.
+
+#+begin_src mermaid :exports none
+sequenceDiagram
+ participant Attacker
+ participant App as WebApplication
+ participant Victim as VictimBrowser
+
+ Attacker->>App: Submit malicious input
+ App->>App: Store or reflect input
+ App->>Victim: HTML/JS page containing payload
+ Victim->>Victim: Browser runs attacker's script
+ Note over Victim: Script runs with the site's origin
can access cookies, DOM, APIs
+#+end_src
+
+The name “cross-site” is historical: classic attacks trick a *victim* into loading a page on *your* app so script runs in *your* origin (stealing session cookies, performing actions as the user, etc.).
+
+Common types:
+
+| Type | Persistence | Typical delivery |
+|-------------+---------------------------------------+----------------------------------|
+| *Reflected* | Not stored; one-off response | Malicious link/query param |
+| *Stored* | Saved server-side (DB, file, session) | Victim loads a normal page later |
+| *DOM-based* | Client-side only | Unsafe innerHTML, eval, etc. |
+
+*Defense in depth:* validate input on the server (whitelist formats), and *encode output* for the exact context (HTML, attribute, JavaScript string, URL).
+
+-----
+
+** What happened in /this/ finding (TMC context)
+
+*** Affected surface (source located)
+
+| Role | Path |
+|-----------------------------+--------------------------------|
+| Page + inline JS | [[file:d:/_dev/WebPortal/src/code/AmberWebUI/SEB/ScheduleExecutionBoard.aspx][ScheduleExecutionBoard.aspx]] |
+| WebMethod + page properties | [[file:d:/_dev/WebPortal/src/code/AmberWebUI/SEB/ScheduleExecutionBoard.aspx.cs][ScheduleExecutionBoard.aspx.cs]] |
+| Session storage | [[file:d:/_dev/WebPortal/src/code/AmberWebUI/SEB/SEBSessionState.cs][SEBSessionState.cs]] |
+
+- *Endpoint:* ASP.NET =[WebMethod]= =SaveSearchCriteriaToSession= on =ScheduleExecutionBoard.aspx=
+- *Parameters:* JSON fields =date=, =orderID=, =time= (also =searchID=, =hours=, =quickSearch= in the same flow)
+- *Host (pentest):* =cert.microlise.com=, path =/PENTEST/TMCWebPortal/SEB/...=
+
+*** Attack flow (as tested)
+
+#+begin_src mermaid
+flowchart LR
+ subgraph submit [Step1_Submit]
+ A[Tester sends POST directly]
+ B[SaveSearchCriteriaToSession]
+ C[Values stored in server session]
+ end
+ subgraph render [Step2_Render]
+ D[User loads ScheduleExecutionBoard.aspx]
+ E[Server embeds session values in script block]
+ F[Browser executes unescaped JS]
+ end
+ A --> B --> C
+ C --> D --> E --> F
+#+end_src
+
+1. *Save:* User (or tester) POSTs JSON to =SaveSearchCriteriaToSession=. The app saves search criteria into the *server-side session*.
+2. *Render:* On the next load of =ScheduleExecutionBoard.aspx=, those values are written into the HTML *inside a =