evilnames

Airbnb, and others, cancellation policies will be a major reason for the spread of this virus. The sunk cost fallacy is alive and well here, people don't want to lose money just because they feel sick even though they know they shouldn't go when not feeling well. I think at this time the travel industry needs to stand up and relax it's policies even further.

Airbnb will not refund you a stay unless your flight has been cancelled by the airline. Unfortunately the airlines are giving options right now, Delta for example let's you rebook or get refunds to some countries that are trying to shut down this virus at it's source. But not feeling safe, along with being given a refund on a nonrefundable ticket does not matter to Airbnb at all. My recommendation is if you have to travel in the next three months to somewhere in Asia or the Mediterranean is to make sure your booking is fully refundable or get in contact with your host prior to booking and see how leniant they are.

If you thought you could get trip insurance to cover the risk you are also going to be in trouble. Your trip insurance will not cover pandemics, read the fine print.

If you want to start looking at application layer pentesting I would review the owasp top 10 and then see how you can apply it to your current projects. I'm constantly using this list and other tricks on any sensitive site that my data resides to hone my skills and make sure there isn't any dumb security flaws that will leak my information. The sad thing is that you'll find cracks in the armor of almost any web service that you use.

I think the most basic test you can practice is just changing the URL if you see a number in it. If you change the number should you see the information that is at the new number? Yes reveals a lot about the website and it's security measures and will let you keep poking further.

Last thing I'll say is, as you practice and learn do not be malicious, even if you could delete an entire set of data because of bad permissions, don't do it. Most, like 90% of companies are relatively appreciative of being told about an exploit. There are some that are not however :(

Practice makes perfect, if you can get marginally better at security them you will write better code and better applications so go for it!