Do me little favour for my new podcast? 🚂💜
If you like hearing me nerd out about how to build safer software, I’d love it if you subscribed to DevSec Station on YouTube, followed it in your favourite podcast app, or did both? 😊 🙏
Thank YOU!
🎥 www.youtube.com/@Dev...
If you like hearing me nerd out about how to build safer software, I’d love it if you subscribed to DevSec Station on YouTube, followed it in your favourite podcast app, or did both? 😊 🙏
Thank YOU!
🎥 www.youtube.com/@Dev...
November 6, 2026 at 12:47 AM
Do me little favour for my new podcast? 🚂💜
If you like hearing me nerd out about how to build safer software, I’d love it if you subscribed to DevSec Station on YouTube, followed it in your favourite podcast app, or did both? 😊 🙏
Thank YOU!
🎥 www.youtube.com/@Dev...
If you like hearing me nerd out about how to build safer software, I’d love it if you subscribed to DevSec Station on YouTube, followed it in your favourite podcast app, or did both? 😊 🙏
Thank YOU!
🎥 www.youtube.com/@Dev...
@kasie.bsky.social kasie, can you retweet this message from my friend Tanya? www.youtube.com/@DevSecStation
DevSec Station
DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you lev...
www.youtube.com
November 6, 2026 at 1:24 AM
@kasie.bsky.social kasie, can you retweet this message from my friend Tanya? www.youtube.com/@DevSecStation
🚨 NEW EPISODE OF DEVSEC STATION! 🚨
**What Permissions Should You Give an AI Agent?**
Last episode, I told you about my little 'Hello Queen' application.
1/6
**What Permissions Should You Give an AI Agent?**
Last episode, I told you about my little 'Hello Queen' application.
1/6
November 5, 2026 at 9:48 PM
🚨 NEW EPISODE OF DEVSEC STATION! 🚨
**What Permissions Should You Give an AI Agent?**
Last episode, I told you about my little 'Hello Queen' application.
1/6
**What Permissions Should You Give an AI Agent?**
Last episode, I told you about my little 'Hello Queen' application.
1/6
Please follow Tanya www.youtube.com/@DevSecStation
DevSec Station
DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you lev...
www.youtube.com
November 6, 2026 at 1:12 AM
Please follow Tanya www.youtube.com/@DevSecStation
@elittlechild.bsky.social my friend Tanya is trying to promote her podcast can you help? www.youtube.com/@DevSecStation
DevSec Station
DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you lev...
www.youtube.com
November 6, 2026 at 1:38 AM
@elittlechild.bsky.social my friend Tanya is trying to promote her podcast can you help? www.youtube.com/@DevSecStation
Im terribly sorry to interrupt you. Can someone of your followers check out my friends podcast www.youtube.com/@DevSecStation
DevSec Station
DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you lev...
www.youtube.com
November 6, 2026 at 1:32 AM
Im terribly sorry to interrupt you. Can someone of your followers check out my friends podcast www.youtube.com/@DevSecStation
@snubs.bsky.social Snubs that one time i bought you kinder eggs from Europe. i know you support female hackers. Please give some support to Tanya www.youtube.com/@DevSecStation
DevSec Station
DevSec Station is a security focused podcast for software developers who want to create amazing applications. Hosted by Tanya Janca, also known as SheHacksPurple, these short lessons will help you lev...
www.youtube.com
November 6, 2026 at 1:17 AM
@snubs.bsky.social Snubs that one time i bought you kinder eggs from Europe. i know you support female hackers. Please give some support to Tanya www.youtube.com/@DevSecStation
In Season 2, Episode 3 of DevSec Station, we're talking about least privilege, permissions versus instructions, meaningful human approval, and how to limit the blast radius when an agent does something unexpected.
4/6
4/6
November 5, 2026 at 9:49 PM
In Season 2, Episode 3 of DevSec Station, we're talking about least privilege, permissions versus instructions, meaningful human approval, and how to limit the blast radius when an agent does something unexpected.
4/6
4/6
I discuss this in DevSec Station Season 2, Episode 2:
What Can Your AI Agent Actually Do?
🎥 YouTube: https://twp.ai/9ObIZv
🎧 Or listen wherever you get your podcasts. Follow DevSec Station for more short, practical lessons on AI and application security.
4/5
What Can Your AI Agent Actually Do?
🎥 YouTube: https://twp.ai/9ObIZv
🎧 Or listen wherever you get your podcasts. Follow DevSec Station for more short, practical lessons on AI and application security.
4/5
youtu.be
What Can Your AI Agent Actually Do?
twp.ai
October 30, 2026 at 2:24 AM
I discuss this in DevSec Station Season 2, Episode 2:
What Can Your AI Agent Actually Do?
🎥 YouTube: https://twp.ai/9ObIZv
🎧 Or listen wherever you get your podcasts. Follow DevSec Station for more short, practical lessons on AI and application security.
4/5
What Can Your AI Agent Actually Do?
🎥 YouTube: https://twp.ai/9ObIZv
🎧 Or listen wherever you get your podcasts. Follow DevSec Station for more short, practical lessons on AI and application security.
4/5
I'm curious how other developers and security folks are handling this.
Do you require AI agents to ask permission before executing code, accessing external services, or making changes to your development environment?
Or do you let them run autonomously?
1/5
Do you require AI agents to ask permission before executing code, accessing external services, or making changes to your development environment?
Or do you let them run autonomously?
1/5
October 30, 2026 at 2:24 AM
I'm curious how other developers and security folks are handling this.
Do you require AI agents to ask permission before executing code, accessing external services, or making changes to your development environment?
Or do you let them run autonomously?
1/5
Do you require AI agents to ask permission before executing code, accessing external services, or making changes to your development environment?
Or do you let them run autonomously?
1/5
GitLab’s PHP2Shell analysis highlights why source-code scanning alone isn’t enough.
Runtime vulnerabilities require visibility into deployed containers, servers and dependencies.
Security depends on understanding what actually runs in production.
about.gitlab.com/blog/gitlab-...
#DevSec #Secure
Runtime vulnerabilities require visibility into deployed containers, servers and dependencies.
Security depends on understanding what actually runs in production.
about.gitlab.com/blog/gitlab-...
#DevSec #Secure
PHP2Shell: GitLab helps find and remediate critical PHP flaws
CVE-2026-109618 and CVE-2026-109619 allow unauthenticated code execution. Learn which PHP versions fix them and how to check your projects.
about.gitlab.com
October 27, 2026 at 8:39 AM
GitLab’s PHP2Shell analysis highlights why source-code scanning alone isn’t enough.
Runtime vulnerabilities require visibility into deployed containers, servers and dependencies.
Security depends on understanding what actually runs in production.
about.gitlab.com/blog/gitlab-...
#DevSec #Secure
Runtime vulnerabilities require visibility into deployed containers, servers and dependencies.
Security depends on understanding what actually runs in production.
about.gitlab.com/blog/gitlab-...
#DevSec #Secure
I share the full story in the latest episode of DevSec Station, along with what happened when my students and I threat modeled it.
🎧 What Can Your AI Agent Actually Do?
Watch on YouTube: https://twp.ai/9ObIbJ
Also available on your favourite podcast app. 💕
The lesson?
4/5
🎧 What Can Your AI Agent Actually Do?
Watch on YouTube: https://twp.ai/9ObIbJ
Also available on your favourite podcast app. 💕
The lesson?
4/5
youtu.be
What Can Your AI Agent Actually Do?
twp.ai
October 26, 2026 at 6:22 PM
I share the full story in the latest episode of DevSec Station, along with what happened when my students and I threat modeled it.
🎧 What Can Your AI Agent Actually Do?
Watch on YouTube: https://twp.ai/9ObIbJ
Also available on your favourite podcast app. 💕
The lesson?
4/5
🎧 What Can Your AI Agent Actually Do?
Watch on YouTube: https://twp.ai/9ObIbJ
Also available on your favourite podcast app. 💕
The lesson?
4/5
Your AI agent's instructions are NOT the same as its permissions.
I think this is one of the most important distinctions developers need to understand as we start integrating agents into our daily work.
You might ask an agent to write some code. Sure.
But can it also:
• Execute that code?
1/5
I think this is one of the most important distinctions developers need to understand as we start integrating agents into our daily work.
You might ask an agent to write some code. Sure.
But can it also:
• Execute that code?
1/5
October 26, 2026 at 6:21 PM
Your AI agent's instructions are NOT the same as its permissions.
I think this is one of the most important distinctions developers need to understand as we start integrating agents into our daily work.
You might ask an agent to write some code. Sure.
But can it also:
• Execute that code?
1/5
I think this is one of the most important distinctions developers need to understand as we start integrating agents into our daily work.
You might ask an agent to write some code. Sure.
But can it also:
• Execute that code?
1/5
October 22, 2026 at 3:38 PM
Find DevSec Station wherever you listen to podcasts. Follow or subscribe so you don't miss the rest of Season 2!
#DevSecStation #AISecurity #AppSec #AIAgents
5/5
#DevSecStation #AISecurity #AppSec #AIAgents
5/5
October 22, 2026 at 5:20 PM
Find DevSec Station wherever you listen to podcasts. Follow or subscribe so you don't miss the rest of Season 2!
#DevSecStation #AISecurity #AppSec #AIAgents
5/5
#DevSecStation #AISecurity #AppSec #AIAgents
5/5
It's just untenable. I can only make our web team take our sites down so many times. Even with a maturing Devsec program, we only have so much resource and time.
October 23, 2026 at 4:27 PM
It's just untenable. I can only make our web team take our sites down so many times. Even with a maturing Devsec program, we only have so much resource and time.
And the resulting application was missing authentication, authorization, and input validation.
Naturally, I brought this into my secure coding class, and we threat modeled it together.
This is the story behind the latest episode of DevSec Station:
3/5
Naturally, I brought this into my secure coding class, and we threat modeled it together.
This is the story behind the latest episode of DevSec Station:
3/5
October 22, 2026 at 5:20 PM
And the resulting application was missing authentication, authorization, and input validation.
Naturally, I brought this into my secure coding class, and we threat modeled it together.
This is the story behind the latest episode of DevSec Station:
3/5
Naturally, I brought this into my secure coding class, and we threat modeled it together.
This is the story behind the latest episode of DevSec Station:
3/5
👑 I asked Claude to build me an app that would call me Queen every morning.
What could possibly go wrong?
Well...
I wanted a cute little application that would greet me, give me a compliment, and share an inspirational quote.
1/5
What could possibly go wrong?
Well...
I wanted a cute little application that would greet me, give me a compliment, and share an inspirational quote.
1/5
October 22, 2026 at 5:20 PM
👑 I asked Claude to build me an app that would call me Queen every morning.
What could possibly go wrong?
Well...
I wanted a cute little application that would greet me, give me a compliment, and share an inspirational quote.
1/5
What could possibly go wrong?
Well...
I wanted a cute little application that would greet me, give me a compliment, and share an inspirational quote.
1/5
Built an open-source dashboard that shows which dev and security tech is established and which is rising on GitHub: stars + 30-day momentum. Hand-curated, so gaps are expected. Issues and PRs welcome.
Source: github.com/sercanvr/dev...
Source: github.com/sercanvr/dev...
GitHub - sercanvr/devsec-status: An informational platform that provides live GitHub data for programming languages, frameworks, libraries, and database technologies. This project displays real-time s...
An informational platform that provides live GitHub data for programming languages, frameworks, libraries, and database technologies. This project displays real-time star counts, total repository v...
github.com
October 15, 2026 at 10:39 PM
Built an open-source dashboard that shows which dev and security tech is established and which is rising on GitHub: stars + 30-day momentum. Hand-curated, so gaps are expected. Issues and PRs welcome.
Source: github.com/sercanvr/dev...
Source: github.com/sercanvr/dev...
Here's something I wish more people understood about AI-generated code:
**Just because it worked yesterday doesn't mean it'll behave the same way tomorrow.**
In one of my secure coding classes, nearly 60 developers gave the same AI assistant the same task and security prompt.
1/3
**Just because it worked yesterday doesn't mean it'll behave the same way tomorrow.**
In one of my secure coding classes, nearly 60 developers gave the same AI assistant the same task and security prompt.
1/3
October 14, 2026 at 11:38 PM
Here's something I wish more people understood about AI-generated code:
**Just because it worked yesterday doesn't mean it'll behave the same way tomorrow.**
In one of my secure coding classes, nearly 60 developers gave the same AI assistant the same task and security prompt.
1/3
**Just because it worked yesterday doesn't mean it'll behave the same way tomorrow.**
In one of my secure coding classes, nearly 60 developers gave the same AI assistant the same task and security prompt.
1/3
That's what I'm exploring in the first episode of DevSec Station Season 2.
It's nine minutes long, and there's one practical thing you can do immediately after listening.
🎧 Your AI Worked 59 Times. What About the 60th?
https://twp.ai/9Obuiy
#ApplicationSecurity #AICoding #DevSecStation
4/4
It's nine minutes long, and there's one practical thing you can do immediately after listening.
🎧 Your AI Worked 59 Times. What About the 60th?
https://twp.ai/9Obuiy
#ApplicationSecurity #AICoding #DevSecStation
4/4
youtu.be
Your AI Worked 59 Times. What About the 60th?
twp.ai
October 11, 2026 at 4:11 PM
That's what I'm exploring in the first episode of DevSec Station Season 2.
It's nine minutes long, and there's one practical thing you can do immediately after listening.
🎧 Your AI Worked 59 Times. What About the 60th?
https://twp.ai/9Obuiy
#ApplicationSecurity #AICoding #DevSecStation
4/4
It's nine minutes long, and there's one practical thing you can do immediately after listening.
🎧 Your AI Worked 59 Times. What About the 60th?
https://twp.ai/9Obuiy
#ApplicationSecurity #AICoding #DevSecStation
4/4