» Tag
appsec
7 postsCodeCrucible: A Reusable Blueprint for LLM-Driven SAST
Block's CodeCrucible offers a reusable design blueprint for LLM-driven SAST, using whole-repo analysis instead of snippet-anchored vulnerability scanning.
SAML Replay Flaw: Signed Assertion, Unsigned Response Envelope
SAML's InResponseTo field is unsigned and strippable, letting attackers bypass replay protection; the fix is binding checks to the signed assertion ID.
OIDC MFA Bypass: How One URL Parameter Skipped the Second Factor
An OIDC login flow let attackers skip MFA by editing a return URL; the fix moves enforcement from the login page to the token-issuing endpoint.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comCVE-2026-69243 PoC: aiohttp Request Smuggling via Rejected WebSocket Upgrade
First public PoC for CVE-2026-69243, an aiohttp request smuggling flaw via rejected WebSocket upgrades causing blind handler invocation behind Nginx.
Lovable Uses AI Hacking Agents to Identify Security Vulnerabilities
Lovable implements AI agents to discover security vulnerabilities innovatively.
How a CORS Flaw Chains Into RCE on WordPress
Misconfigured CORS headers in WordPress plugins can chain with CSRF and file upload flaws into full RCE. A technical breakdown for bug bounty researchers.
AI Code Audit: 15 Security Flaws Claude Found in Production
An LLM-based security audit uncovered 15 OWASP-classified flaws-SQL/NoSQL injection, IDOR, path traversal-each shown with vulnerable and fixed code.