Dev.to Security

Proton Pass vs Bitwarden: Which Password Manager Fits You?

Two open-source password managers with strong free tiers, compared on features, privacy, pricing, an…

Rotating the Hostile Seat: A Six-Round Adversarial Design Review Before Hardening an Agent

Originally published on hexisteme notes. I was about to harden a new agent whose whole job is to tu…

Reflected XSS in E-Commerce Search — Bug Bounty Writeup

Introduction This one's a Reflected XSS I found during a bug bounty hunt, and it reinforced a less…

Speech isn't free if a processor can switch it off.

Speech isn't free if a processor can switch it off. When money and messaging run through the same mi…

DevGuard AI: A Self-Observing Multi-Agent Security Pipeline Built on SigNoz

The Problem Manual security code review costs roughly $85/hour of engineer time and doesn't scale …

What Rooting an "Easy" HTB Box Taught Me About Chained Vulnerabilities

I do AppSec triage for a living — mostly reading through Bugcrowd submissions and reasoning about wh…

The Hidden Costs of Building a Blockchain App from Scratch

Building a decentralized application (dApp) or blockchain-powered platform offers incredible promise…

Android ADB Hardening, Chrome Global Shortcut Hijack, & SQLite Shell History Tool

Android ADB Hardening, Chrome Global Shortcut Hijack, & SQLite Shell History Tool Today's…

I Let an Agent Take Over an Account With Every Permission Check Green

Clone it. Run it. Tell me where I'm wrong. git clone https://github.com/keniel13-ui/sequence-atta…

AI Agent Safety and Compliance Tools: A 2026 Comparison

Three categories of AI agent safety tooling: observability, security guardrails, and compliance evid…

I kept seeing weird stuff on my VPS, so I built a tool to stop guessing

A few weeks ago I noticed some things I couldn't explain on one of my VPS instances — nothing catast…

Sanitize a MikroTik RouterOS Config Before You Share It

MikroTik just shipped RouterOS 7.21.5 (long-term) and 6.49.20 on July 6, which means a lot of sysadm…