The leading API security company, providing the context needed to discover APIs, stop attacks, and remediate vulnerabilities to accelerate business innovation.

Byoky is an open-source AI API key wallet that lets AI apps use your keys without seeing them, but its no-servers claim needs a closer look.

We’re a group of security and technology experts with a mission to fix gaps in application security.

How per-route authentication enforcement is prone to development mistakes and security flaws.

The leading API security company, providing the context needed to discover APIs, stop attacks, and remediate vulnerabilities to accelerate business innovation.

Explore how Cloudflare Connect 2026 addresses the security of agents in the digital landscape, emphasizing the importance of identity, integrity & authority

A training platform leaks sensitive military and defense sector data through an API showing signs of Broken Functional Level Authorization (OWASP 2023:API5)

A South Korean government-sponsored platform suffered a critical API data breach. Did the frontend mask risks lurking in the backend until it was too late?

We’re a group of security and technology experts with a mission to fix gaps in application security.

TL;DR CERT/CC published a vulnerability note on October 27, 2026, disclosing an unpatched Xerj authentication bypass tracked as CVE-2026-97406. This flaw allows attackers with existing bearer tokens to mint persistent credentials without required passkey verifications. Consequently, unauthorized users can maintain permanent administrative access even after administrators revoke the initial token. Why It Matters Xerj serves as an open-source search engine tailored for artificial intelligence agents using the Elasticsearch API.

The leading API security company, providing the context needed to discover APIs, stop attacks, and remediate vulnerabilities to accelerate business innovation.

Security and DevOps teams choose Wallarm to discover all cloud-native APIs and legacy web applications running in their environment, and to detect & respond to threats against them.

Explore the evolving landscape of connected vehicle security, focusing on API trust, operational technology, and the implications of the EU Cyber Resilience Act.

OpenCode has suffered a security breach that exposed developer API keys and raised serious concerns about AI security. Discover what happened, how the incident affected users of OpenAI, Anthropic, Google, and other AI services, why unauthorized usage can lead to massive bills, and how developers can protect their API credentials against future attacks.

Prominent Japanese software distributor Sourcenext recently issued an urgent security notice to its customers. Specifically, unauthorized actors abused an internal member information query API to harvest vast amounts of customer data. Consequently, the company estimated that the incident compromised up to 22,519,960 customer records. The exposed database contained registered email addresses, account passwords, legal names, physical addresses, and telephone numbers. Although the exact compromised data fields vary across individual profiles, Sourcenext proactively reset all customer passwords.

API Pentesting Tools are specialized security tools used to test and analyze the security of Application Programming Interfaces (APIs). - yogsec/API-Pentesting-Tools

OpenCode says a breach of a legacy system may have exposed third-party AI provider keys belonging to a small group of Console users, including keys for OpenAI, Anthropic and Google.