Northflank's advice after its breach: revoke at the issuing provider, don't just swap the value.
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
November 2, 2026 at 6:30 AM
Northflank's advice after its breach: revoke at the issuing provider, don't just swap the value.
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
Looking for your AppSec match?
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
November 1, 2026 at 2:08 PM
Looking for your AppSec match?
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
TC - CS - CTM - Appsec - Senior Job educativ.net/jobs/job/67774...
November 2, 2026 at 4:02 PM
TC - CS - CTM - Appsec - Senior Job educativ.net/jobs/job/67774...
The security question for agent tools is not just 'does it work?' It is 'what can it do when it is wrong, compromised, or over-permissioned?' #AIAgents #AppSec
October 31, 2026 at 5:19 PM
The security question for agent tools is not just 'does it work?' It is 'what can it do when it is wrong, compromised, or over-permissioned?' #AIAgents #AppSec
My opening presentation from today’s unprompted, in SF.
Self heal from attacks, “solve” AppSec, and rethink threat intelligence.
All, in discussion how to be, and stay, “AI native” through our hobbies. In my case? Vuln research.
docs.google.com/presentation...
Self heal from attacks, “solve” AppSec, and rethink threat intelligence.
All, in discussion how to be, and stay, “AI native” through our hobbies. In my case? Vuln research.
docs.google.com/presentation...
Being AI-Native Relevant - The Hobby Way
Being AI-Native Relevant. The Hobby Way. Vuln Research >> Code in Place >>“Solving” AppSec >> Threat Intelligence Gadi Evron - CEO & Co-founder, Knostic, CISO-in-Residence for AI, CSA - Chair, [un]pro...
docs.google.com
October 29, 2026 at 6:03 PM
My opening presentation from today’s unprompted, in SF.
Self heal from attacks, “solve” AppSec, and rethink threat intelligence.
All, in discussion how to be, and stay, “AI native” through our hobbies. In my case? Vuln research.
docs.google.com/presentation...
Self heal from attacks, “solve” AppSec, and rethink threat intelligence.
All, in discussion how to be, and stay, “AI native” through our hobbies. In my case? Vuln research.
docs.google.com/presentation...
A few weeks ago, I gave a guest lecture to the cybersecurity course at the Univeristy of Applied Science @htwberlin.bsky.social
Guest Lecture at HTW Berlin: AppSec in the Age of Agentic Engineering
My HTW Berlin guest lecture explains why agentic engineering moves AppSec toward harness design, platform constraints, and measurable risk.
www.janbrennenstuhl.eu
October 29, 2026 at 7:21 PM
A few weeks ago, I gave a guest lecture to the cybersecurity course at the Univeristy of Applied Science @htwberlin.bsky.social
Learn more about our #osco sponsors: opensecurityconference.org/support/spon...
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
Our Sponsors
Welcome to the Open Security Conference (osco), the people-centred international gathering for everyone interested in cybersecurity. Join us 5-8 November 2026 in Rückersbach, Germany.
opensecurityconference.org
November 2, 2026 at 2:51 PM
Learn more about our #osco sponsors: opensecurityconference.org/support/spon...
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
Part 4 of our Android kernel exploit chain: CVE-2023-20938, a Binder use-after-free on a Pixel 6 running Android 12.
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
November 2, 2026 at 10:42 AM
Part 4 of our Android kernel exploit chain: CVE-2023-20938, a Binder use-after-free on a Pixel 6 running Android 12.
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
While some manufacturers have made genuine progress reducing recurring classes of coding error, the industry as a whole has not. It's important to separate effort from outcomes — hiring an appsec team and acquiring tools are necessary but not sufficient to reduce customer harm.
October 31, 2026 at 12:02 PM
While some manufacturers have made genuine progress reducing recurring classes of coding error, the industry as a whole has not. It's important to separate effort from outcomes — hiring an appsec team and acquiring tools are necessary but not sufficient to reduce customer harm.
If your AI builder wrote your Stripe webhook, look for signature verification (constructEvent with your endpoint secret).
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
November 2, 2026 at 12:50 PM
If your AI builder wrote your Stripe webhook, look for signature verification (constructEvent with your endpoint secret).
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
The latest update for #AikidoSecurity includes "#AI agent security in #Kubernetes: Why prompt injection isn't the right term" and "How to patch PHP2Shell with free Aikido Images".
#Cybersecurity #AppSec #DevSecOps https://opsmtrs.com/48vGyRP
#Cybersecurity #AppSec #DevSecOps https://opsmtrs.com/48vGyRP
Aikido
Aikido Security is an automated application security platform designed specifically for software engineering teams.
opsmtrs.com
October 31, 2026 at 4:30 AM
The latest update for #AikidoSecurity includes "#AI agent security in #Kubernetes: Why prompt injection isn't the right term" and "How to patch PHP2Shell with free Aikido Images".
#Cybersecurity #AppSec #DevSecOps https://opsmtrs.com/48vGyRP
#Cybersecurity #AppSec #DevSecOps https://opsmtrs.com/48vGyRP
OWASP Agentic AI GOAT: Hands-On Hacking of Multi-Agent LLM Systems at Global AppSec USA 2026 + Video
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
OWASP Agentic AI GOAT: Hands-On Hacking of Multi-Agent LLM Systems at Global AppSec USA 2026 + Video
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The upcoming presentation at OWASP Global AppSec USA 2026 addresses these risks by launching the open-source platform OWASP Agentic AI GOAT, designed to evaluate and secure multi-agent LLM systems. Learning Objectives & Secrets: Objective 1: Master the exploitation mechanics of prompt injection, direct prompt injection, and goal hijacking within agentic workflows.
undercodetesting.com
November 1, 2026 at 10:35 AM
OWASP Agentic AI GOAT: Hands-On Hacking of Multi-Agent LLM Systems at Global AppSec USA 2026 + Video
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
dreamgroup.com
Chained PHP2Shell Exploit Roots 25 Servers | Dream Research
twp.ai
October 28, 2026 at 3:10 AM
If your app calls OpenAI, Claude or Gemini straight from the browser, anyone can copy the key from DevTools.
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
OpenAI, Claude or Gemini API key exposed in your frontend? What to do now
How to check your live JavaScript, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
abbilabs.xyz
November 1, 2026 at 10:30 AM
If your app calls OpenAI, Claude or Gemini straight from the browser, anyone can copy the key from DevTools.
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
Two questions for every Supabase Storage bucket:
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
November 2, 2026 at 10:40 AM
Two questions for every Supabase Storage bucket:
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
The recording of Mireia Cano's and my OWASP Global AppSec EU talk is out now! 🤩 Check it out if you want to learn "Security Champions: Lessons from Opposite Trenches" and/or want to see us get theatrically dramatic on stage. 😄 youtu.be/4vERcT0ewg0 #OWASPVienna26 #OWASP #AppSec #SecurityChampions
Security Champions: Lessons From Opposite Trenches - Lisi Hocke & Mireia Cano
YouTube video by OWASP Foundation
youtu.be
October 28, 2026 at 6:44 PM
The recording of Mireia Cano's and my OWASP Global AppSec EU talk is out now! 🤩 Check it out if you want to learn "Security Champions: Lessons from Opposite Trenches" and/or want to see us get theatrically dramatic on stage. 😄 youtu.be/4vERcT0ewg0 #OWASPVienna26 #OWASP #AppSec #SecurityChampions
In just 3 steps, you can set up the CrowdSec WAF, a free and open-source web application firewall:
1. Install the rule collections
2. Turn on the AppSec Component
3. Point your bouncer at it
Full guide: docs.crowdsec.net/docs/appsec/...
#WAF #opensource
1. Install the rule collections
2. Turn on the AppSec Component
3. Point your bouncer at it
Full guide: docs.crowdsec.net/docs/appsec/...
#WAF #opensource
October 28, 2026 at 8:02 AM
In just 3 steps, you can set up the CrowdSec WAF, a free and open-source web application firewall:
1. Install the rule collections
2. Turn on the AppSec Component
3. Point your bouncer at it
Full guide: docs.crowdsec.net/docs/appsec/...
#WAF #opensource
1. Install the rule collections
2. Turn on the AppSec Component
3. Point your bouncer at it
Full guide: docs.crowdsec.net/docs/appsec/...
#WAF #opensource
RLS on isn't the whole job. A Supabase policy that says using (true) lets anyone with your anon key read every row. Check Authentication > Policies and swap it for auth.uid() = user_id.
#Supabase #vibecoding #AppSec #Lovable #nocode #webdev #buildinpublic #Cursor #indiehackers #SaaS #AI #devtools
#Supabase #vibecoding #AppSec #Lovable #nocode #webdev #buildinpublic #Cursor #indiehackers #SaaS #AI #devtools
Is RLS on, but one policy lets everyone read?
Turning on Row Level Security is only half the job. A policy written as using (true) opens the table to anyone holding your public anon key.
abbilabs.xyz
October 30, 2026 at 9:05 PM
RLS on isn't the whole job. A Supabase policy that says using (true) lets anyone with your anon key read every row. Check Authentication > Policies and swap it for auth.uid() = user_id.
#Supabase #vibecoding #AppSec #Lovable #nocode #webdev #buildinpublic #Cursor #indiehackers #SaaS #AI #devtools
#Supabase #vibecoding #AppSec #Lovable #nocode #webdev #buildinpublic #Cursor #indiehackers #SaaS #AI #devtools
I'd love to hear how people are approaching this. Are you using approval gates? Sandboxing? Restricted permissions? Something else? And how much autonomy are you comfortable giving your agents? 😬
#AISecurity #AppSec #AIAgents #DevSecStation
5/5
#AISecurity #AppSec #AIAgents #DevSecStation
5/5
October 30, 2026 at 2:24 AM
I'd love to hear how people are approaching this. Are you using approval gates? Sandboxing? Restricted permissions? Something else? And how much autonomy are you comfortable giving your agents? 😬
#AISecurity #AppSec #AIAgents #DevSecStation
5/5
#AISecurity #AppSec #AIAgents #DevSecStation
5/5
Blog post: www.zaproxy.org/blog/2026-11...
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
ZAP Updates - October 2026
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
www.zaproxy.org
November 2, 2026 at 12:46 PM
Blog post: www.zaproxy.org/blog/2026-11...
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
#Google just announced Gemini 4 Carbon as its strongest model yet, built for cybersecurity and long horizon work.
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...
Gemini 4 Carbon: our next frontier model
Gemini 4 Carbon is our strongest model with state-of-the-art cybersecurity and long horizon capabilities.
blog.google
November 1, 2026 at 2:45 PM
#Google just announced Gemini 4 Carbon as its strongest model yet, built for cybersecurity and long horizon work.
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...
The latest update for #GitGuardian includes "How GitGuardian Secures the Credential Layer: From Discovery to Remediation" and "#GitHub Octoverse 2026: AI Agents, Citizen Developers, and the New Security Reality".
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
GitGuardian
GitGuardian is the code security platform for the DevOps generation.
opsmtrs.com
October 31, 2026 at 3:50 AM
The latest update for #GitGuardian includes "How GitGuardian Secures the Credential Layer: From Discovery to Remediation" and "#GitHub Octoverse 2026: AI Agents, Citizen Developers, and the New Security Reality".
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
October’s AppSec roundup: #AI "explanations", threat modeling, PHP disclosure, + AI as a systems problem.
Different topics, same underlying question: how do we make security decisions with better evidence and accountability?
Also, a lot of #cyber #games. SO MANY!
shostack.org/blog/appsec-...
Different topics, same underlying question: how do we make security decisions with better evidence and accountability?
Also, a lot of #cyber #games. SO MANY!
shostack.org/blog/appsec-...
Appsec roundup - September/October 2026
New threat model tools, a PHP bug, chain-of-thought isn’t, and ... we’re not playing games here, or are we?
shostack.org
October 29, 2026 at 10:32 PM
October’s AppSec roundup: #AI "explanations", threat modeling, PHP disclosure, + AI as a systems problem.
Different topics, same underlying question: how do we make security decisions with better evidence and accountability?
Also, a lot of #cyber #games. SO MANY!
shostack.org/blog/appsec-...
Different topics, same underlying question: how do we make security decisions with better evidence and accountability?
Also, a lot of #cyber #games. SO MANY!
shostack.org/blog/appsec-...
Back by popular demand and thanks to our friends at Aikido Security
The OWASP Global AppSec USA Conference Kick-Off Party
📅 Wednesday, November 4th
⏰ 7:00 pm - 10:00 pm.
📍Location to be shared upon registration
Join the party: owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
The OWASP Global AppSec USA Conference Kick-Off Party
📅 Wednesday, November 4th
⏰ 7:00 pm - 10:00 pm.
📍Location to be shared upon registration
Join the party: owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
October 30, 2026 at 7:11 PM
Back by popular demand and thanks to our friends at Aikido Security
The OWASP Global AppSec USA Conference Kick-Off Party
📅 Wednesday, November 4th
⏰ 7:00 pm - 10:00 pm.
📍Location to be shared upon registration
Join the party: owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
The OWASP Global AppSec USA Conference Kick-Off Party
📅 Wednesday, November 4th
⏰ 7:00 pm - 10:00 pm.
📍Location to be shared upon registration
Join the party: owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
One of my old bosses was fond of appending the EICAR string to his passwords and boy did that reveal a lot of cursed appsec practices
October 30, 2026 at 10:57 PM
One of my old bosses was fond of appending the EICAR string to his passwords and boy did that reveal a lot of cursed appsec practices