Hiding your AI key in an edge function is step one. Step two: make sure it won't serve strangers.
No caller check and no rate limit means your endpoint becomes the leaked key.
Verify the JWT, cap requests per user, set a provider spend limit.
#vibecoding #Supabase #AppSec #OpenAI #nocode #webdev
No caller check and no rate limit means your endpoint becomes the leaked key.
Verify the JWT, cap requests per user, set a provider spend limit.
#vibecoding #Supabase #AppSec #OpenAI #nocode #webdev
November 2, 2026 at 8:35 PM
False emergency alerts have real-world consequences. Protect who can publish, enforce approval limits, and give the public an independent way to verify urgent instructions. https://www.hexon.bot/blog/emergency-alert-app-security #Cybersecurity #EmergencyAlerts #AppSec
November 2, 2026 at 6:30 PM
False emergency alerts have real-world consequences. Protect who can publish, enforce approval limits, and give the public an independent way to verify urgent instructions. https://www.hexon.bot/blog/emergency-alert-app-security #Cybersecurity #EmergencyAlerts #AppSec
Term of the day: Container Escape
A container escape occurs when an application or process running inside a container gains unauthorized access to resources outside of it, such as the host operating system or...
Full definition: appsecuritystandards.org/glossary/container-escape
#AppSec #infosec
A container escape occurs when an application or process running inside a container gains unauthorized access to resources outside of it, such as the host operating system or...
Full definition: appsecuritystandards.org/glossary/container-escape
#AppSec #infosec
November 2, 2026 at 4:04 PM
Term of the day: Container Escape
A container escape occurs when an application or process running inside a container gains unauthorized access to resources outside of it, such as the host operating system or...
Full definition: appsecuritystandards.org/glossary/container-escape
#AppSec #infosec
A container escape occurs when an application or process running inside a container gains unauthorized access to resources outside of it, such as the host operating system or...
Full definition: appsecuritystandards.org/glossary/container-escape
#AppSec #infosec
TC - CS - CTM - Appsec - Senior Job educativ.net/jobs/job/67774...
November 2, 2026 at 4:02 PM
TC - CS - CTM - Appsec - Senior Job educativ.net/jobs/job/67774...
Learn more about our #osco sponsors: opensecurityconference.org/support/spon...
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
Our Sponsors
Welcome to the Open Security Conference (osco), the people-centred international gathering for everyone interested in cybersecurity. Join us 5-8 November 2026 in Rückersbach, Germany.
opensecurityconference.org
November 2, 2026 at 2:51 PM
Learn more about our #osco sponsors: opensecurityconference.org/support/spon...
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
If your AI builder wrote your Stripe webhook, look for signature verification (constructEvent with your endpoint secret).
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
November 2, 2026 at 12:50 PM
If your AI builder wrote your Stripe webhook, look for signature verification (constructEvent with your endpoint secret).
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
Blog post: www.zaproxy.org/blog/2026-11...
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
ZAP Updates - October 2026
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
www.zaproxy.org
November 2, 2026 at 12:46 PM
Blog post: www.zaproxy.org/blog/2026-11...
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
Part 4 of our Android kernel exploit chain: CVE-2023-20938, a Binder use-after-free on a Pixel 6 running Android 12.
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
November 2, 2026 at 10:42 AM
Part 4 of our Android kernel exploit chain: CVE-2023-20938, a Binder use-after-free on a Pixel 6 running Android 12.
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
Two questions for every Supabase Storage bucket:
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
November 2, 2026 at 10:40 AM
Two questions for every Supabase Storage bucket:
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
Northflank's advice after its breach: revoke at the issuing provider, don't just swap the value.
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
November 2, 2026 at 6:30 AM
Northflank's advice after its breach: revoke at the issuing provider, don't just swap the value.
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
The pytm team is happy to report that for this week's "OWASP by Design" at Globap AppSec SF 2026, we are releasing a bug fixing release, 1.4.1.But the big news now is that we dropped the error-prone manual release process and are now releasing via Github with full provenance!
November 1, 2026 at 9:43 PM
The pytm team is happy to report that for this week's "OWASP by Design" at Globap AppSec SF 2026, we are releasing a bug fixing release, 1.4.1.But the big news now is that we dropped the error-prone manual release process and are now releasing via Github with full provenance!
The pytm team is happy to report that for this week's "OWASP by Design" at Globap AppSec SF 2026, we are releasing a bug fixing release, 1.4.1.But the big news now is that we dropped the error-prone manual release process and are now releasing via Github with full provenance!
November 1, 2026 at 9:43 PM
The pytm team is happy to report that for this week's "OWASP by Design" at Globap AppSec SF 2026, we are releasing a bug fixing release, 1.4.1.But the big news now is that we dropped the error-prone manual release process and are now releasing via Github with full provenance!
Patrick Collison asks if apps with an agent-powered "improvements" box can be secure.
Only if the box is treated like any public input: no prod keys in the agent's reach, and a human reads every change to login or database rules.
#vibecoding #AI #AppSec #infosec #webdev #devtools #nocode
Only if the box is treated like any public input: no prod keys in the agent's reach, and a human reads every change to login or database rules.
#vibecoding #AI #AppSec #infosec #webdev #devtools #nocode
November 1, 2026 at 8:35 PM
Back by popular demand and thanks to our friends at Aikido Security
The OWASP Global AppSec USA Conference Kick-Off Party
📅 Wednesday, November 4th
⏰ 7:00 pm - 10:00 pm.
📍Location to be shared upon registration
Join the party: owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
The OWASP Global AppSec USA Conference Kick-Off Party
📅 Wednesday, November 4th
⏰ 7:00 pm - 10:00 pm.
📍Location to be shared upon registration
Join the party: owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
November 1, 2026 at 8:11 PM
Back by popular demand and thanks to our friends at Aikido Security
The OWASP Global AppSec USA Conference Kick-Off Party
📅 Wednesday, November 4th
⏰ 7:00 pm - 10:00 pm.
📍Location to be shared upon registration
Join the party: owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
The OWASP Global AppSec USA Conference Kick-Off Party
📅 Wednesday, November 4th
⏰ 7:00 pm - 10:00 pm.
📍Location to be shared upon registration
Join the party: owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
Term of the day: Configuration Drift
Configuration drift is when a system's actual settings gradually move away from the intended or approved setup over time. This can happen because of manual changes...
Full definition: appsecuritystandards.org/glossary/configuration-drift
#AppSec #infosec
Configuration drift is when a system's actual settings gradually move away from the intended or approved setup over time. This can happen because of manual changes...
Full definition: appsecuritystandards.org/glossary/configuration-drift
#AppSec #infosec
November 1, 2026 at 4:04 PM
Term of the day: Configuration Drift
Configuration drift is when a system's actual settings gradually move away from the intended or approved setup over time. This can happen because of manual changes...
Full definition: appsecuritystandards.org/glossary/configuration-drift
#AppSec #infosec
Configuration drift is when a system's actual settings gradually move away from the intended or approved setup over time. This can happen because of manual changes...
Full definition: appsecuritystandards.org/glossary/configuration-drift
#AppSec #infosec
#Google just announced Gemini 4 Carbon as its strongest model yet, built for cybersecurity and long horizon work.
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...
Gemini 4 Carbon: our next frontier model
Gemini 4 Carbon is our strongest model with state-of-the-art cybersecurity and long horizon capabilities.
blog.google
November 1, 2026 at 2:45 PM
#Google just announced Gemini 4 Carbon as its strongest model yet, built for cybersecurity and long horizon work.
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...
Looking for your AppSec match?
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
November 1, 2026 at 2:08 PM
Looking for your AppSec match?
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
OWASP Agentic AI GOAT: Hands-On Hacking of Multi-Agent LLM Systems at Global AppSec USA 2026 + Video
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
OWASP Agentic AI GOAT: Hands-On Hacking of Multi-Agent LLM Systems at Global AppSec USA 2026 + Video
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The upcoming presentation at OWASP Global AppSec USA 2026 addresses these risks by launching the open-source platform OWASP Agentic AI GOAT, designed to evaluate and secure multi-agent LLM systems. Learning Objectives & Secrets: Objective 1: Master the exploitation mechanics of prompt injection, direct prompt injection, and goal hijacking within agentic workflows.
undercodetesting.com
November 1, 2026 at 10:35 AM
OWASP Agentic AI GOAT: Hands-On Hacking of Multi-Agent LLM Systems at Global AppSec USA 2026 + Video
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
If your app calls OpenAI, Claude or Gemini straight from the browser, anyone can copy the key from DevTools.
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
OpenAI, Claude or Gemini API key exposed in your frontend? What to do now
How to check your live JavaScript, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
abbilabs.xyz
November 1, 2026 at 10:30 AM
If your app calls OpenAI, Claude or Gemini straight from the browser, anyone can copy the key from DevTools.
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
Vite's "hidden" source maps still ship .map files, just without the pointer comment. Add .map to a script URL and curl it: 200 means your source is public. Rotate any key inside.
abbilabs.xyz/tips/hidden-...
#vite #javascript #webdev #infosec #vibecoding #nextjs #AppSec
abbilabs.xyz/tips/hidden-...
#vite #javascript #webdev #infosec #vibecoding #nextjs #AppSec
Are your "hidden" source maps still public?
Hiding the comment that points to a source map does not remove the .map file. A one-line curl check, and how to make sure maps never ship.
abbilabs.xyz
October 31, 2026 at 9:05 PM
Vite's "hidden" source maps still ship .map files, just without the pointer comment. Add .map to a script URL and curl it: 200 means your source is public. Rotate any key inside.
abbilabs.xyz/tips/hidden-...
#vite #javascript #webdev #infosec #vibecoding #nextjs #AppSec
abbilabs.xyz/tips/hidden-...
#vite #javascript #webdev #infosec #vibecoding #nextjs #AppSec
2026 Application Access Governance Report #appsec
2026 Application Access Governance Report
Groups
Conversations
All groups and messages
Sign in
Technical - Application Security
Conversations
About
Privacy • Terms
2026 Application Access Governance Report
0 views
Skip to first unread message
Eyal Estrin
unread,
12:29 PM (25 minutes ago)
to
https://delinea.com/hubfs/Delinea/whitepapers/delinea-2026-application-access-governance-research-report.pdf
Eyal Estrin
Author | Cloud Architect | AWS • Azure • GCP Insights
Social: @eyalestrin
Connect: https://linktr.ee/eyalestrin Blog: https://security-24-7.com
Reply all
Reply to author
Forward
dlvr.it
October 31, 2026 at 7:54 PM
2026 Application Access Governance Report #appsec