Eresus research, advisory, and security news
We collect writing, advisories, and current-event analysis around AI security, the MCP ecosystem, application security, and real attack chaining here.
Latest Posts
File Upload Security: Testing the Pipeline End to End
A practical review of validation, parser isolation, storage, download authorization, scanning, and asynchronous upload pipelines.
SAML SSO Security Testing: Assertions, Signatures, and Tenant Mapping
A practical review of SAML assertion signatures, audience, recipient, replay, certificate rotation, and tenant provisioning.
Password Reset and Account Recovery Security Testing
A practical guide to account enumeration, reset-token design, email links, MFA recovery, support workflows, and session revocation.
GraphQL API Security Testing: Resolver Access, Batching, and Cost
A practical GraphQL assessment guide covering resolver and field authorization, batching, query cost, introspection, and error exposure.
DAST Findings Need More Than a Severity Score: HTTP Evidence and OAST Callbacks
A practical method for reviewing DAST findings with the request, response, scope, and out-of-band evidence that engineering needs to reproduce them.
Authenticated DAST Testing: Scope, Test Accounts, and Safe Scan Boundaries
Plan authenticated DAST without losing authorization boundaries: define hosts, identities, state-changing actions, exclusions, and retest conditions before a scan.
From AppSec Finding to Verified Fix: A Remediation and Retest Workflow
Turn a scanner or review result into a closed risk with ownership, impact context, a testable fix, evidence retention, and a scoped retest.
Agentic SAST Without Guesswork: File-Level Evidence, Validation, and Trace
How to review agent-assisted static analysis: inspect the pinned repository, source-to-sink path, exact code location, validation, and the limits of each finding.
Webhook Security Testing: Signatures, Replay, and Delivery
A practical guide to signatures, freshness, replay, idempotency, tenant isolation, queues, and callback risks in webhook integrations.