Cybersecurity

Threat Modelling an AI Feature

You do not need a new methodology for AI features. You need the one you have, applied to a system wh…

I ran a passive security check on 100 freshly launched products — 1 in 5 shipped with zero security headers

Last week I posted the results of checking 10 products that had just launched. The pattern was so co…

Boosting Online Security for Remote Workers in the US

Boosting Online Security for Remote Workers in the US The shift to remote work has become a perman…

Adding WebAuthn to a multi-tenant NestJS + Next.js app: what nobody tells you

Passwords in 2026 are the cheapest attacker surface you own. You rotate them, you salt them, you mak…

Authentication vs Authorization: Basic Auth, Sessions, OAuth, OIDC, JWT, SSO, and RBAC vs ABAC Explained

Authentication and authorization get used almost interchangeably in casual conversation, and confuse…

DPAs and Sub-Processors for AI Vendors

A data processing agreement is a boring document that answers exactly the questions an AI integratio…

CVE-2026-71851: CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom)

CVE-2026-71851: Use of Cryptographically Weak PRNG in crypto-js (Ill Bloom) Vulnerability ID: CVE…

Copyright and AI Output: Who Owns It

“Who owns AI output?” is three questions bundled together, answered by three different bodies of rul…

Account Pre-Hijacking via Social Sign-In

Account pre-hijacking inverts the usual order. The attacker does not break into an existing account;…

Escaping Tutorial Hell: Building FrontDesk

Recently, I decided it was time to step out of tutorial hell and actually build a serious full-stack…

Does BrassCoders Work With Django REST Framework?

Yes — DRF Code Scans the Same as Any Python BrassCoders scans Django REST Framework projects at th…

Security news weekly round-up - 7th August 2026

Despite the popularity of AI and the events surrounding it, we should not forget that vulnerabilitie…