26 articles tagged with Appsec.
A SHA pin that nobody checks is a label, not a control. Plugin4Shell showed that four major coding agents never checked.
Business logic vulnerabilities exploit legitimate application workflows rather than broken code, so scanners routinely miss them entirely.
GraphQL's single flexible endpoint creates attack surfaces REST checklists miss, from introspection exposure to query depth and batching abuse.
Secrets slip into git through habit and haste, and the only reliable fix is catching them before they're committed, not after.
A practical comparison of static and dynamic application security testing, what each catches, and how to combine them in your pipeline.
JWTs get misused in the same handful of ways across codebases, from trusting the algorithm header to skipping issuer and audience checks.
Security misconfiguration quietly outranks flashier bugs as a top cause of breaches, yet teams rarely treat it as a real engineering problem.
Insecure deserialization lets attackers turn untrusted data into arbitrary code execution, and here's how it happens and how to stop it.
SSRF tricks a server into making requests on an attacker's behalf, often reaching cloud metadata endpoints or internal systems the attacker could never hit directly.
A practitioner's guide to broken access control and IDOR, why scanners miss them, and how to authorize every request correctly.
A practical field guide to the secure coding habits that stop the vulnerabilities attackers actually exploit in production.
LLM and agent apps add a new attack surface on top of every classic one. The threats that are specific to AI, mapped to the OWASP lists, and the boundary controls that actually contain them.
