DEV Community

#appsec

Application security topics beyond the web, including mobile and desktop applications.

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
🪟 Clickjacking: When a Missing X-Frame-Options Is a Real Bug
krishna_kumar_75bdf350b26 profile

🪟 Clickjacking: When a Missing X-Frame-Options Is a Real Bug

#security #webdev #bugbounty #appsec
1
Comments 1
10 min read
Vulnerability assessment vs penetration testing: what two scanners found in 27 known flaws
alygg77 profile

Vulnerability assessment vs penetration testing: what two scanners found in 27 known flaws

#testing #devops #security #appsec
Comments
10 min read
I couldn't find an AI agent for AppSec audits, so I built one and benchmarked it on real CVEs
seelentov profile
vlfd

I couldn't find an AI agent for AppSec audits, so I built one and benchmarked it on real CVEs

#security #ai #opensource #appsec
1
Comments
8 min read
What 191 AppSec job postings actually ask developers for (Nov 2026)
cyberjobscc profile

What 191 AppSec job postings actually ask developers for (Nov 2026)

#security #career #appsec #ai
Comments
5 min read
🧟 Old API Versions: Find the /v1 That Never Died, Then Prove It
krishna_kumar_75bdf350b26 profile

🧟 Old API Versions: Find the /v1 That Never Died, Then Prove It

#security #api #bugbounty #appsec
Comments
11 min read
Securing Agent-to-Agent Workflows: 10 Flaws to Spot
securitystefan profile

Securing Agent-to-Agent Workflows: 10 Flaws to Spot

#security #ai #a2a #appsec
1
Comments
5 min read
How well do prompt injection defenses work? 1,800 trials, 4 defenses, 3 models
alygg77 profile

How well do prompt injection defenses work? 1,800 trials, 4 defenses, 3 models

#security #ai #llm #appsec
Comments 1
8 min read
ReDoS: catastrophic backtracking in a regex input check
alygg77 profile

ReDoS: catastrophic backtracking in a regex input check

#security #webdev #appsec #regex
Comments
8 min read
Why MCP OAuth Discovery Leads to SSRF
securitystefan profile

Why MCP OAuth Discovery Leads to SSRF

#security #oauth #appsec #node
1
Comments
6 min read
The session list checked the owner, the session ID didn't: cross-project form-session IDOR in CommCare formplayer (GHSA-qjg7-cgv8-3c43)
santosh_kumarpuppala_96e profile

The session list checked the owner, the session ID didn't: cross-project form-session IDOR in CommCare formplayer (GHSA-qjg7-cgv8-3c43)

#security #java #appsec #spring
Comments
6 min read
PUT checked the project space, DELETE didn't: cross-tenant deletes in the CommCare HQ API (GHSA-hq38-78vf-f4cj)
santosh_kumarpuppala_96e profile

PUT checked the project space, DELETE didn't: cross-tenant deletes in the CommCare HQ API (GHSA-hq38-78vf-f4cj)

#security #python #django #appsec
Comments
6 min read
A search box that JOINed to your token table: ORM filter injection in KoboToolbox (GHSA-xrq7-925g-qg5m)
santosh_kumarpuppala_96e profile

A search box that JOINed to your token table: ORM filter injection in KoboToolbox (GHSA-xrq7-925g-qg5m)

#security #python #django #appsec
Comments
8 min read
SQL injection example: login bypass and UNION reads on a local API
alygg77 profile

SQL injection example: login bypass and UNION reads on a local API

#security #webdev #appsec #sql
Comments
8 min read
Race condition vulnerability in a single-use coupon endpoint
alygg77 profile

Race condition vulnerability in a single-use coupon endpoint

#security #webdev #appsec #concurrency
Comments
8 min read
IDOR vulnerability: a local example with PUT and DELETE
alygg77 profile

IDOR vulnerability: a local example with PUT and DELETE

#security #webdev #appsec #idor
Comments
7 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.