AppSec, threat modeling, SBOMs, secrets, SAST/DAST, authN/Z, and privacy by design.
An article joins this feed when it matches these terms. Each one is also a search of its own.
Bearer CLI is a free static application security testing (SAST) tool that scans source code for vulnerabilities and prioritizes them by the sensitive data they touch. SAST means the tool reads code without running it. Organizations can use it freely,…
80% of security leaders say departing employees walk off with IP. The hard part isn’t outside hackers, it’s the people you already handed… Insider Threat and IP Protection: Preventing Loss by Those You Trust 80% of security leaders say departing employees walk…
OAuth tests often stop at the redirect. That misses an important part of the trust story: what happens when a user must prove control of an email address before the authorization flow is considered complete? The email is not just…
OAuth tests often stop at “the token was returned.” That proves the protocol completed, but it does not prove that the right client, tenant, user, or scope received access. A test token can be cryptographically valid and still represent a…
OAuth test accounts are often treated as disposable infrastructure. A script creates a user, requests a verification email, follows a link, exchanges a code, and deletes the account. The flow looks harmless because the data is synthetic. But synthetic does…
Two days ago my daily GitHub digest pipeline returned nothing. That is the state of "GitHub Trending" as a data source: one HTML page, no API, no fallback, and it can vanish from your network without telling you. So I…
Live Webinar and Q&A: From Tokens to Features: Architecting Cost Attribution for AI-Assisted Engineering (Oct 29, 2026) Save Your Seat Discover how to keep software evolvable as systems, technology, and teams shift. This edition explores agentic fitness functions for semantic drift, treating…
In web application security, some vulnerabilities don’t require complicated payloads or sophisticated exploitation techniques. Sometimes, a simple change to a resource identifier can reveal a serious access control weakness. Two terms frequently discussed in this context are IDOR (Insecure Direct…
This article is finalization of two previous pieces one and two. Token authentication is realization of “Pay for registration” concept. This concept has several benefits: no CAPTCHA which collects your data, no stupid and over-complicated OAUTH, no other stupid things…
Mage detects unknown OAuth providers as an error but fails to halt session creation — the error handler creates a valid authenticated session anyway. Heath — Forkast T/I/S Heath Callahan Trust, Identity & Security All stories by Heath Callahan → |[email protected] Heath…