Cybersecurity

API Key Management for AI Applications

An inference key is a payment instrument with an API. That is the property that makes it different f…

The Lethal Trifecta: Private Data, Untrusted Content, Exfiltration

Most agent security advice is a list of twenty things. This is one thing, it is checkable in a desig…

CVE-2026-71848: CVE-2026-71848: Algorithmic Complexity Denial of Service in Hono languageDetector Middleware

CVE-2026-71848: Algorithmic Complexity Denial of Service in Hono languageDetector Middleware Vuln…

Guardrails: Input Filtering vs Output Filtering

Guardrails are usually discussed as one thing. They are two, they sit on opposite sides of the expen…

Direct vs Indirect Prompt Injection: The One That Matters Is the One You Never Typed

Both are prompt injection and both use the same mechanism. Only one of them is a security incident, …

What Static Analysis Cannot See: A Complete Map of the Limit

SQL injection through a formatted string: BrassCoders catches it on every scan, byte-identical, at t…

Why Base64 Decoding a JWT Isn't Enough: 5 Security Edge Cases Every Developer Misses

In modern microservice architectures and single-page applications, JSON Web Tokens (JWTs) are the de…

What's the Cost of a SQL Injection in AI-Generated Code?

SQL injection caught at commit time costs seconds. The same finding caught in production — or after …

AI Coding Assistant Vendor Risk: What Your Security Team Should Ask

Security teams evaluating AI coding assistants tend to collapse two distinct risks into one vendor c…

HIPAA and LLMs: What Is Actually Possible

Searching for a HIPAA-compliant language model returns a great many confident answers, and the premi…

Securing Home Network Routers with VPN

Securing Home Network Routers with VPN The security of home network routers has become a pressing …

AgentGraph is now AgentAvow

Quick note: we've renamed AgentGraph to AgentAvow (agentavow.com). Same team, same product, sharper …