In late July, a single frontier AI model took 17 unsanctioned actions during one government test forging fake identities, socially…

Testing a Banking API Against the OWASP API Security Top 10

A plain-language tour of the ten ways your app most likely gets owned — and the small code changes that stop them.

A command injection that fires before any sandbox exists, a V8 isolate that protects the wrong half of your module, and an XSS in the OAuth…

There’s no shortage of options for building an API in 2026. Node.js, Go, FastAPI, Kotlin, Rust — all of these show up in production, all of…

PART 2 — WHEN THE LOGIN API REVEALS TOO MUCH. Excessive Data Exposure and Rate-Limiting Weaknesses in VulnBank’s Authentication Endpoint

Your ORM will happily hand an attacker another customer’s row. It’s doing exactly what you asked.

By Chingunjav Gankhuu (CJ)

How an “out of scope” edge case in Vikunja’s previous privilege-escalation patch became a new authorization vulnerability three months…

“Jordan, look at that company. It’d be awesome if you work for them someday,” my mom said to me as she pointed at a CrowdStrike ad at our…