Archive
Research archive, page 4
Page 4 of 159 published articles on AI security, application security, supply chain, and real attack chains.
Webhook Security Testing: Signatures, Replay, and Delivery
A practical guide to signatures, freshness, replay, idempotency, tenant isolation, queues, and callback risks in webhook integrations.
RAG Authorization and Tenant Isolation Testing
How to test ACL synchronization, tenant filters, cache leakage, citations, and document deletion in RAG systems.
Pass-the-Passkey: A WebAuthn Security Testing Guide
Passkey security testing guide for relying parties and endpoints: challenge binding, replay rejection, account recovery, native prompts, and session controls.
OAuth and OIDC Security Testing for SaaS
A hands-on review of Authorization Code, PKCE, redirects, state, nonce, token audience, account linking, and tenant membership.
Mobile App Security: Tokens, Deep Links, and API Trust
A practical Android and iOS guide to token storage, deep links, device signals, and server-side authorization.
GitSpawn: AI Coding Agent Repository Security Guide
Learn how GitSpawn turns untrusted Git metadata into coding-agent risk, how to assess your exposure, and secure developer workflows before opening code.
AI Penetration Testing: How to Validate an Agent's Findings
AI penetration testing can speed up reconnaissance, but every finding needs reproducible evidence, a verified impact path, and human review.
AI Agent Identity Security: Trace the Path Behind Every Tool Call
Secure AI agents by tracing who can invoke them, which identity they use downstream, and what each tool call can reach.
AI Agent Data Exposure: An Incident Response Guide
Learn what AI coding agents leave on endpoints, how to investigate token or transcript exposure, and how to contain risk without over-collecting data.