Northflank's advice after its breach: revoke at the issuing provider, don't just swap the value.
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
November 2, 2026 at 6:30 AM
Northflank's advice after its breach: revoke at the issuing provider, don't just swap the value.
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
An old key works until OpenAI, Stripe or Supabase kills it. Then check usage.
#infosec #devops #vibecoding #AppSec #indiehackers #buildinpublic #AI #webdev #security #SaaS #cybersecurity #startups
Looking for your AppSec match?
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
November 1, 2026 at 2:08 PM
Looking for your AppSec match?
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
Meet The Mentor is coming to Global AppSec San Francisco! Think speed dating, but for mentors & mentees. Meet face-to-face, start a conversation, see if you click… and maybe find your perfect mentorship match!
owasp.glueup.com/eve...
#OWASPSanFran26 #GlobalAppSec26
TC - CS - CTM - Appsec - Senior Job educativ.net/jobs/job/67774...
November 2, 2026 at 4:02 PM
TC - CS - CTM - Appsec - Senior Job educativ.net/jobs/job/67774...
Learn more about our #osco sponsors: opensecurityconference.org/support/spon...
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
Our Sponsors
Welcome to the Open Security Conference (osco), the people-centred international gathering for everyone interested in cybersecurity. Join us 5-8 November 2026 in Rückersbach, Germany.
opensecurityconference.org
November 2, 2026 at 2:51 PM
Learn more about our #osco sponsors: opensecurityconference.org/support/spon...
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
#osco26 #Security #CyberSecurity #InfoSec #AppSec #OTSecurity [lisi] 2/2
Part 4 of our Android kernel exploit chain: CVE-2023-20938, a Binder use-after-free on a Pixel 6 running Android 12.
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
November 2, 2026 at 10:42 AM
Part 4 of our Android kernel exploit chain: CVE-2023-20938, a Binder use-after-free on a Pixel 6 running Android 12.
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
Freed kernel pages come back as epoll objects, and two ordinary syscalls read any address.
👉 www.eshard.com/blog/kernel-...
#appsec #cybersecurity #reverseengineering #exploit
The security question for agent tools is not just 'does it work?' It is 'what can it do when it is wrong, compromised, or over-permissioned?' #AIAgents #AppSec
October 31, 2026 at 5:19 PM
The security question for agent tools is not just 'does it work?' It is 'what can it do when it is wrong, compromised, or over-permissioned?' #AIAgents #AppSec
If your AI builder wrote your Stripe webhook, look for signature verification (constructEvent with your endpoint secret).
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
November 2, 2026 at 12:50 PM
If your AI builder wrote your Stripe webhook, look for signature verification (constructEvent with your endpoint secret).
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
Without it, anyone who finds the URL can send a fake "payment succeeded" event and get your paid plan free.
#Stripe #vibecoding #SaaS #indiehackers #AppSec
If an RLS policy checks auth.jwt() -> 'user_metadata' for a role, any user can grant themselves that role. user_metadata is editable by the user via updateUser().
Keep roles in app_metadata or a table only admins can write.
#Supabase #vibecoding #AppSec #Lovable #nocode #infosec #webdev #Bolt
Keep roles in app_metadata or a table only admins can write.
#Supabase #vibecoding #AppSec #Lovable #nocode #infosec #webdev #Bolt
November 3, 2026 at 12:50 PM
OWASP Agentic AI GOAT: Hands-On Hacking of Multi-Agent LLM Systems at Global AppSec USA 2026 + Video
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
OWASP Agentic AI GOAT: Hands-On Hacking of Multi-Agent LLM Systems at Global AppSec USA 2026 + Video
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The upcoming presentation at OWASP Global AppSec USA 2026 addresses these risks by launching the open-source platform OWASP Agentic AI GOAT, designed to evaluate and secure multi-agent LLM systems. Learning Objectives & Secrets: Objective 1: Master the exploitation mechanics of prompt injection, direct prompt injection, and goal hijacking within agentic workflows.
undercodetesting.com
November 1, 2026 at 10:35 AM
OWASP Agentic AI GOAT: Hands-On Hacking of Multi-Agent LLM Systems at Global AppSec USA 2026 + Video
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
Introduction: The rapid evolution of autonomous systems has introduced complex attack vectors, bridging traditional web vulnerabilities with modern Large Language Model (LLM) architectures. The…
The latest update for #GitGuardian includes "The Binance Hack Raises a Critical Question: What Can a Compromised Laptop Reach?" and "Your Leaked Secrets Now Show Up in Wiz".
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
GitGuardian
GitGuardian is the code security platform for the DevOps generation.
opsmtrs.com
November 3, 2026 at 2:02 AM
The latest update for #GitGuardian includes "The Binance Hack Raises a Critical Question: What Can a Compromised Laptop Reach?" and "Your Leaked Secrets Now Show Up in Wiz".
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
#cybersecurity #DevOps #infosec #appsec https://opsmtrs.com/3XY1xZb
New guide: is your Supabase storage bucket public?
How to check which buckets are public, which storage.objects policies let anyone list files, a curl test, and the fix: private bucket, per-user folder policies, signed URLs.
#Supabase #vibecoding #Lovable #Bolt #AppSec #buildinpublic
How to check which buckets are public, which storage.objects policies let anyone list files, a curl test, and the fix: private bucket, per-user folder policies, signed URLs.
#Supabase #vibecoding #Lovable #Bolt #AppSec #buildinpublic
Is your Supabase storage bucket public? How to check it and lock it down
Check public buckets and storage.objects policies, test listing with curl, and move to private buckets with per-user folders and signed URLs.
abbilabs.xyz
November 3, 2026 at 1:40 AM
New guide: is your Supabase storage bucket public?
How to check which buckets are public, which storage.objects policies let anyone list files, a curl test, and the fix: private bucket, per-user folder policies, signed URLs.
#Supabase #vibecoding #Lovable #Bolt #AppSec #buildinpublic
How to check which buckets are public, which storage.objects policies let anyone list files, a curl test, and the fix: private bucket, per-user folder policies, signed URLs.
#Supabase #vibecoding #Lovable #Bolt #AppSec #buildinpublic
While some manufacturers have made genuine progress reducing recurring classes of coding error, the industry as a whole has not. It's important to separate effort from outcomes — hiring an appsec team and acquiring tools are necessary but not sufficient to reduce customer harm.
October 31, 2026 at 12:02 PM
While some manufacturers have made genuine progress reducing recurring classes of coding error, the industry as a whole has not. It's important to separate effort from outcomes — hiring an appsec team and acquiring tools are necessary but not sufficient to reduce customer harm.
If your app calls OpenAI, Claude or Gemini straight from the browser, anyone can copy the key from DevTools.
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
OpenAI, Claude or Gemini API key exposed in your frontend? What to do now
How to check your live JavaScript, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
abbilabs.xyz
November 1, 2026 at 10:30 AM
If your app calls OpenAI, Claude or Gemini straight from the browser, anyone can copy the key from DevTools.
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
New guide: how to check in 2 minutes, the order to fix it in, and a prompt for Lovable, Bolt or Cursor.
#vibecoding #AppSec #webdev #OpenAI #Lovable #buildinpublic #security
Two questions for every Supabase Storage bucket:
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
November 2, 2026 at 10:40 AM
Two questions for every Supabase Storage bucket:
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
1. Is it public? Then anyone with a file URL can download it.
2. Can strangers list it? A broad SELECT policy on storage.objects lets them.
Profile photos: public is fine. Documents: private, signed URLs.
#Supabase #vibecoding #AppSec #Lovable
Hiding your AI key in an edge function is step one. Step two: make sure it won't serve strangers.
No caller check and no rate limit means your endpoint becomes the leaked key.
Verify the JWT, cap requests per user, set a provider spend limit.
#vibecoding #Supabase #AppSec #OpenAI #nocode #webdev
No caller check and no rate limit means your endpoint becomes the leaked key.
Verify the JWT, cap requests per user, set a provider spend limit.
#vibecoding #Supabase #AppSec #OpenAI #nocode #webdev
November 2, 2026 at 8:35 PM
The latest update for #Zenity includes "Introducing HAMMER, the Homegrown Agent Maturity Model for Execution & Risk" and "The First Questions That Matter: Triaging #AI Agent Security Incidents".
#cybersecurity #lowcodesecurity #appsec https://opsmtrs.com/3GN6TxH
#cybersecurity #lowcodesecurity #appsec https://opsmtrs.com/3GN6TxH
Zenity
Design and implement governance policies, identify security risks, detect emerging threats and drive automatic mitigation and response.
opsmtrs.com
November 3, 2026 at 2:16 AM
The latest update for #Zenity includes "Introducing HAMMER, the Homegrown Agent Maturity Model for Execution & Risk" and "The First Questions That Matter: Triaging #AI Agent Security Incidents".
#cybersecurity #lowcodesecurity #appsec https://opsmtrs.com/3GN6TxH
#cybersecurity #lowcodesecurity #appsec https://opsmtrs.com/3GN6TxH
The latest update for #AikidoSecurity includes "#AI agent security in #Kubernetes: Why prompt injection isn't the right term" and "How to patch PHP2Shell with free Aikido Images".
#Cybersecurity #AppSec #DevSecOps https://opsmtrs.com/48vGyRP
#Cybersecurity #AppSec #DevSecOps https://opsmtrs.com/48vGyRP
Aikido
Aikido Security is an automated application security platform designed specifically for software engineering teams.
opsmtrs.com
October 31, 2026 at 4:30 AM
The latest update for #AikidoSecurity includes "#AI agent security in #Kubernetes: Why prompt injection isn't the right term" and "How to patch PHP2Shell with free Aikido Images".
#Cybersecurity #AppSec #DevSecOps https://opsmtrs.com/48vGyRP
#Cybersecurity #AppSec #DevSecOps https://opsmtrs.com/48vGyRP
Your RLS can be perfect and a view can still leak the table. Postgres views run with the owner's rights by default.
New guide: find them with one query, test with your public key, fix with security_invoker.
#Supabase #Postgres #vibecoding #AppSec #Lovable #Bolt #webdev #buildinpublic
New guide: find them with one query, test with your public key, fix with security_invoker.
#Supabase #Postgres #vibecoding #AppSec #Lovable #Bolt #webdev #buildinpublic
Supabase "Security Definer View" warning: why your view bypasses RLS and how to fix it
Find views that ignore your RLS, test them with your public key, and fix them with security_invoker, revokes or a separate table.
abbilabs.xyz
November 3, 2026 at 10:40 AM
Your RLS can be perfect and a view can still leak the table. Postgres views run with the owner's rights by default.
New guide: find them with one query, test with your public key, fix with security_invoker.
#Supabase #Postgres #vibecoding #AppSec #Lovable #Bolt #webdev #buildinpublic
New guide: find them with one query, test with your public key, fix with security_invoker.
#Supabase #Postgres #vibecoding #AppSec #Lovable #Bolt #webdev #buildinpublic
My opening presentation from today’s unprompted, in SF.
Self heal from attacks, “solve” AppSec, and rethink threat intelligence.
All, in discussion how to be, and stay, “AI native” through our hobbies. In my case? Vuln research.
docs.google.com/presentation...
Self heal from attacks, “solve” AppSec, and rethink threat intelligence.
All, in discussion how to be, and stay, “AI native” through our hobbies. In my case? Vuln research.
docs.google.com/presentation...
Being AI-Native Relevant - The Hobby Way
Being AI-Native Relevant. The Hobby Way. Vuln Research >> Code in Place >>“Solving” AppSec >> Threat Intelligence Gadi Evron - CEO & Co-founder, Knostic, CISO-in-Residence for AI, CSA - Chair, [un]pro...
docs.google.com
October 29, 2026 at 6:03 PM
My opening presentation from today’s unprompted, in SF.
Self heal from attacks, “solve” AppSec, and rethink threat intelligence.
All, in discussion how to be, and stay, “AI native” through our hobbies. In my case? Vuln research.
docs.google.com/presentation...
Self heal from attacks, “solve” AppSec, and rethink threat intelligence.
All, in discussion how to be, and stay, “AI native” through our hobbies. In my case? Vuln research.
docs.google.com/presentation...
A few weeks ago, I gave a guest lecture to the cybersecurity course at the Univeristy of Applied Science @htwberlin.bsky.social
Guest Lecture at HTW Berlin: AppSec in the Age of Agentic Engineering
My HTW Berlin guest lecture explains why agentic engineering moves AppSec toward harness design, platform constraints, and measurable risk.
www.janbrennenstuhl.eu
October 29, 2026 at 7:21 PM
A few weeks ago, I gave a guest lecture to the cybersecurity course at the Univeristy of Applied Science @htwberlin.bsky.social
SPDX転職ガイド｜AppSec・CI/CDとの違い
選び方やポイントを確認したい方はこちら👇
https://it-career.serenity-nova.com/articles/spdx-career
選び方やポイントを確認したい方はこちら👇
https://it-career.serenity-nova.com/articles/spdx-career
November 3, 2026 at 3:08 PM
SPDX転職ガイド｜AppSec・CI/CDとの違い
選び方やポイントを確認したい方はこちら👇
https://it-career.serenity-nova.com/articles/spdx-career
選び方やポイントを確認したい方はこちら👇
https://it-career.serenity-nova.com/articles/spdx-career
The two-account test for AI-built apps:
Make two accounts. As A, create something private and copy its URL or id. As B, open that URL, or put A's id into one of B's requests.
If B sees A's data, any logged-in user can read everyone's rows.
#vibecoding #Supabase #AppSec #webdev
Make two accounts. As A, create something private and copy its URL or id. As B, open that URL, or put A's id into one of B's requests.
If B sees A's data, any logged-in user can read everyone's rows.
#vibecoding #Supabase #AppSec #webdev
November 3, 2026 at 6:35 AM
The two-account test for AI-built apps:
Make two accounts. As A, create something private and copy its URL or id. As B, open that URL, or put A's id into one of B's requests.
If B sees A's data, any logged-in user can read everyone's rows.
#vibecoding #Supabase #AppSec #webdev
Make two accounts. As A, create something private and copy its URL or id. As B, open that URL, or put A's id into one of B's requests.
If B sees A's data, any logged-in user can read everyone's rows.
#vibecoding #Supabase #AppSec #webdev
Blog post: www.zaproxy.org/blog/2026-11...
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
ZAP Updates - October 2026
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
www.zaproxy.org
November 2, 2026 at 12:46 PM
Blog post: www.zaproxy.org/blog/2026-11...
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
OAuth2 support has landed in the Authentication Helper, the Browser Extension has a new Script Viewer, ZAP can detect PHP2Shell, and we explain how we’re developing ZAP in the LLM age.
#zaproxy #appsec
I'm going to be at OWASP Global AppSec USA this week. If you're in SF, would love to see you in the Testing track on Thursday at 11:30 AM.
owasp.glueup.com/event/owasp-...
owasp.glueup.com/event/owasp-...
November 3, 2026 at 10:33 PM
I'm going to be at OWASP Global AppSec USA this week. If you're in SF, would love to see you in the Testing track on Thursday at 11:30 AM.
owasp.glueup.com/event/owasp-...
owasp.glueup.com/event/owasp-...
#Google just announced Gemini 4 Carbon as its strongest model yet, built for cybersecurity and long horizon work.
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...
Gemini 4 Carbon: our next frontier model
Gemini 4 Carbon is our strongest model with state-of-the-art cybersecurity and long horizon capabilities.
blog.google
November 1, 2026 at 2:45 PM
#Google just announced Gemini 4 Carbon as its strongest model yet, built for cybersecurity and long horizon work.
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...
#AI #Cybersecurity #Gemini #AppSec #CodingAgents
blog.google/innovation-a...