Johnny Cold·Oct 23SSRF Is Not About the Code. It’s About Where the Code Runs.Here is a Go handler. Is it vulnerable?
Tɧε Pεntεstįng Mątėrįål·Sep 25Master Source Code Review: A Step-by-Step Guide to Finding High-Severity Logic Flaws &…From manual code auditing to identifying security risks in modern applications — here is my complete playlist/learning path.
Gupta Bless·Aug 10Stop Using Generic AI Prompts: Build Structured Claude Skills for SecurityIntroduction
Johnny Cold·Jul 27I Audited an Open-Source Go Web Project: CORS Leakage & Unauthenticated WebSocketsWhen building microservices and web APIs in Go, performance and simplicity often take the spotlight. However, during secure code reviews, I…
Robert Broeckelmann·Jul 23Secure Code Reviews: Finding Security Issues Before Attackers DoThis post is also published on the IyaSec blog.
h@shtalk·Jul 17Can AI write secure code? I audited 50 AI-Generated snippetsA real, hands-on audit — methodology, sources, and the actual code, broken down line by line.
Declerus Yves Kerbens·Jun 20Why White-box Assessment Matters More Than Ever in the Era of AIWhy the future of application security is not just scanning, but reasoning across systems
Aryah·May 17Remote Code Execution (RCE) from a Secure Code Review PerspectiveI know It’s been a long time since I published anything related to secure code review.After taking a break, everything felt new again. Busy…
InTowards AIbyJosh Conkel·May 3Yin, Yang, and the LLM: Engineering Reliability into AI Code ScanningHow Statistical Quality Control, Not Prompt Engineering, Reduced My AI Accuracy Problems
Suraj Vishwakarma·Apr 25How to Find Real Vulnerabilities Using Source -> Flow -> SinkThere are several mental models worth building as a security engineer. This is one of the more practical ones — and one that’s often…
