How to read more security + engineering booksAnd some book recommendations for 2022–23Aug 25, 202372610Aug 25, 202372610
Writing Secure GPT PromptsPrompt engineering: learning to write robust and secure promptsAug 2, 2023491Aug 2, 2023491
Why is Copilot giving me bad codeExploring security issues in code generation LLM toolsJun 27, 2023741Jun 27, 2023741
Hacking LLMs with prompt injectionsAnd ways hackers can attack GPT-based applicationsJun 1, 20236475Jun 1, 20236475
Tech Writing vs GPTIs AI replacing technical writers and developer advocates?Apr 13, 2023441Apr 13, 2023441
Published inBetter ProgrammingChatGPT: Build me a Recon Tool!Using ChatGPT to build a simple hacking recon toolMar 30, 20233205Mar 30, 20233205
Published inBetter ProgrammingThoughts on the Book, “Designing Secure Software: A Guide for DevelopersAppSec engineer’s book club #001 — discussing Loren Kohnfelder’s bookJan 10, 2023142Jan 10, 2023142
Published inBetter ProgrammingSameSite Cookie AttacksAnd what subdomain takeovers mean for your SameSite cookiesJun 15, 20221985Jun 15, 20221985
Published inShiftLeft BlogSecurity and privacy in a world of digital identityInterview with Shinesa Cambric, Principal Product Manager at MicrosoftApr 20, 2022333Apr 20, 2022333
Published inShiftLeft BlogBreaking the entry-level barrier with Jasmine JacksonLaunching your career in cybersecurity with self-studyApr 14, 202227Apr 14, 202227
Published inShiftLeft BlogSpring4Shell: Spring Remote Code Execution VulnerabilitySpring unauthenticated RCE via classLoader manipulationApr 2, 2022Apr 2, 2022
Published inShiftLeft BlogAngular + React: Vulnerability CheatsheetThe most common vulnerabilities to look out for in Angular and React applications: template injection, XSSI, authentication bypass, and…Mar 1, 20222Mar 1, 20222
Published inShiftLeft BlogAnnouncing the AppSec Ambassador ProgramPassionate about securing software? Become an AppSec Ambassador!Feb 23, 2022Feb 23, 2022
Published inShiftLeft BlogNode.js Vulnerability Cheatsheet25 vulnerabilities to look out for in Node JS applications: Directory traversal, prototype pollution, XSSI, and more…Feb 17, 20221Feb 17, 20221
Published inShiftLeft BlogNetworking and growing your career in infosec with Vandana VermaOWASP leader Vandana’s tips for navigating your career in infosecFeb 15, 2022Feb 15, 2022
Published inShiftLeft BlogWhat is insecure deserialization?Getting to know a critical vulnerability that affects Java, Python, and other common programming languages.Feb 8, 20222Feb 8, 20222
Published inShiftLeft BlogHacking and Securing Python Applications27 vulnerabilities to look out for in Python applications: Arbitrary file writes, directory traversal, deserialization, and more…Jan 20, 2022Jan 20, 2022
Published inShiftLeft BlogSocial responsibility in infosec with Chloé MessdaghiDiscussing environmental and social issues in infosec with ESG researcher Chloé MessdaghiJan 19, 2022Jan 19, 2022
Published inShiftLeft BlogLooking back on the Log4j WeekendLesson learned, and what we can expect going forwardDec 22, 2021Dec 22, 2021
Published inShiftLeft BlogLog4Shell: Apache Log4j Remote Code ExecutionUnauthenticated RCE in critical Java logging utility Log4jDec 10, 20214Dec 10, 20214