Cybersecurity

GitLab Duo Security Review Flow goes after the logic bugs SAST leaves on the floor

I keep a small mental tally of merge requests where the static scanner shrugged and a human caught t…

Read a JWT without guessing what's inside

Read a JWT without guessing what's inside A JWT shows up in almost every auth flow you'll touch: O…

Why Every Programmer Needs a Durable Leather Backpack

There was a time when my daily routine looked almost the same no matter where I worked. Some days be…

5 false positives that fool naive Solidity scanners (and how to kill them at the root)

In a paid audit, a false positive is not just noise — it's a credibility killer. Hand a founder a "C…

HMAC-Signed Webhooks: Securing Your Event Stream

HMAC-Signed Webhooks: Securing Your Event Stream Webhooks are powerful—they let external systems r…

Beware: Gitlawb Zero v0.4.0 Closed a Hole Where a Cloned Repo Could Re-Enable the MCP Servers You Disabled

You disabled an MCP server. You trust it's off. That assumption is exactly what Gitlawb Zero v0.4.0…

Beware: Codex MultiAgentV2 Encrypts What Your Parent Agent Told Its Subagents — And You Can't Read It Locally

Here is a diagnostic scenario that used to be routine and is now, on certain Codex models, close to …

What 60 documented AI agent failures reveal about coding-agent risk

I've been maintaining a CVE-style database of real, sourced AI coding-agent failures — each one seve…

Building a Safe AI DevOps Agent: From Slack Diagnosis to Verified Pull Requests

Giving an AI agent access to production is easy. Explaining exactly what it can read, what it can ch…

I Benchmarked 4 SAST Tools Against 164 CVEs — Here's What Found 100% of Them

If you're building software in 2026, you probably have some form of security scanning. Bandit for Py…

Cursor Keeps Skipping Rate Limits on Login Routes (CWE-307)

TL;DR I checked 50 AI-generated login endpoints. Zero had rate limiting. Attackers can brute-forc…

Detecting OAuth Threats with Entra ID Logs

and-how-to-detect-t-824cde37.webp alt: 3 OAuth TTPs Seen This Month — and How to Detect Them with …