Essential security strategies for early-stage startups to minimize risks while facilitating smoother audits.   #strategy

Post diving into the core aspects of SCIM (System for Cross-domain Identity Management), and the insecure design issues often found while testing its implementations.   #attack   #saas

Post examining the cryptography behind passkeys, the guarantees they do or do not give, and interesting cryptographic things you can do with them, such as generating cryptographic keys and storing certificates.   #explain

Post showing how Nix enables definitive proof that your system image is derived solely from a specific, trusted set of sources, including all dependencies and build tools.   #build   #ci/cd   #supply-chain

A cloud attack targeting Amazon SES and persistence via AWS Lambda, AWS IAM Identity Center and AWS IAM.   #attack   #aws   #defend

This post provides a 9-step, 18-point checklist of secrets management best practices to use as a guide for your journey.   #build   #defend   #vault

An Azure utility for mounting Azure Storage that comes preinstalled on Azure HPC/AI images allowed an unprivileged user on a Linux machine with this utility installed to escalate their privileges to root.   #attack   #azure

Post introducing the concept of LLM TTPs (Tactics, Techniques, and Procedures) to categorize how adversaries exploit LLMs, highlighting the importance of prompts in this context.   #ai   #defend

Two bugs in kro (Kube Resource Orchestrator) where an attacker could introduce a malicious CustomResourceDefinition (CRD).   #attack   #kubernetes

A collection of detection rules for security monitoring and detailed descriptions of log fields used for threat analysis within Okta environments.

Take a list of domains, crawl urls and scan for endpoints, secrets, api keys, file extensions, tokens and more.

VAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios through Exercises.

An HTTP server that acts as a bridge between HTTP/1.1 requests and Server-Sent Events (SSE) using the mcp python library. You can also refer to the companion blog post.

Post explaining how ISO/IEC 42001 enables effective AI governance, review the risk management requirements, and explore how you can use threat modeling as a practical technique to meet those expectations.

Post explaining guardrail implementation strategies.