Checking one application for customer data, another for communication, another for reports, and yet another for tasks may only take a few…

Threat modeling when the asset you’re protecting is money.

Implementing “Shift Left, Verify Right” in a Vulnerable FinTech Microservices Application In my previous article, I introduced the concept of “Shift Left, Verify Right,” a DevSecOps …

📢 The solution to Challenge #1: Schooled is live. Watch the video walkthrough here, or read the full write-up on GitHub.

There is a special kind of optimism that exists in software development.

Hiding keys in native code creates a false perimeter. Chained with deep links, they enable silent backend compromise.

Georgia Tech tracked CVEs traceable to AI coding tools — 6, then 15, then 35 in three straight months.

As reliance on third-party SaaS and PaaS solutions grows, vendor software has become a critical, yet vulnerable, extension of the corporate…

I Built an AI-Powered Security Code Review Tool. Here’s What I Learned. I review a lot of code. As an application security engineer, I spend hours reading other people’s pull requests looking for …

22nd July 2026, Netherlands — Certificates are commonly used to secure communication between applications, APIs, databases, message…

Introduction

Part 3 of the “Implementing DevSecOps” series

Supabase is a good product. It is also, by design, a Postgres database exposed directly to the public internet. Your browser talks to that…

In the realm of web application security, Insecure Direct Object Reference (IDOR) stands out as a critical vulnerability that often goes…

Introduction

Open redirect bugs are deceptively simple — and deceptively easy to get wrong. A single string-matching mistake in a “safe domain” check…

I’m excited to announce that I’ll be returning to Black Hat Arsenal 2026 in Las Vegas and SecTor 2026 in Canada to demo OWASP Faction 2.0 —…

Introduction