Source Code in a Public Bucket: When .git/ Survives Deployment
✓ Human-authored analysis; AI used for formatting and proofreading. A static-site S3 bucket is, by design, public. Marketing copy, infographics, dow…
Testing & QA
⚑ Сообщить о проблемеПоследние новости Testing & QA от Tech News
Все темы
agents
ai
api
architecture
automation
backend
beginners
career
claude
cybersecurity
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
node
opensource
performance
productivity
programming
python
security
showdev
softwareengineering
testing
tutorial
typescript
webdev
Поиски «швейцарского ножа» или Обзор инструментов моделирования угроз
Привет, Хабр! Меня зовут Антон Станкевичус, я старший специалист по тестированию безопасности программного обеспечения в компании «Гарда». Моделиров…
AI Is Finding Vulnerabilities Faster Than Humans Can Patch Them — And That’s Becoming a Security Crisis
For years, cybersecurity had one obvious problem: Finding vulnerabilities was difficult. Researchers had to inspect code, reproduce strange behavior…
Agentic AI Security: Credentials and Permissions Define the Blast Radius
Agentic AI Security: Credentials and Permissions Define the Blast Radius Prompt injection can't be patched away. Three 2026 agentic AI incidents sho…
The Webhook is the Persistence: RBAC Misconfiguration in EKS
✓ Human-authored analysis; AI used for formatting and proofreading. A Kubernetes admission webhook is a piece of code that intercepts every API call…
The POST was guarded, the GET on the same URL was not: cross-tenant PII disclosure in CoopCycle (GET /api/stores/{id}/addresses)
TL;DR What: In coopcycle-web — the open-source logistics and marketplace platform that worker-owned courier co-operatives self-host instead of renti…
A SQL escape is not a shell escape: OS command injection in GOautodial goAPIv2
TL;DR What: In GOautodial's goAPIv2 agent API, the goPhone request parameter is escaped for SQL ( mysqli_real_escape_string ) and then concatenated…
First Action After Compromise: Blind the Audit
✓ Human-authored analysis; AI used for formatting and proofreading. If you're an attacker who's just landed in an AWS account, the most expensive th…
Why SAST and DAST Aren't Enough for Secrets Security
If you run an application security program in 2026, secrets detection can look like a solved line item. Your static analysis suite ships rules for h…
Junior AppSec Engineer Overwhelmed by Massive Code Reviews: Strategies for Efficiency and Confidence
Introduction: The Systemic Failure in Application Security Onboarding Consider the scenario of a junior Application Security Engineer tasked with se…
Разгоняем GateAI — часть 2: бесплатная модель против Claude
В первой части я разогнал GateAI кэшированием, нашёл несколько багов и проверил триаж на DVWA и pyGoat. Теперь решил прогнать те же задачи через бес…
Разгоняем GateAI
Кэшировал агентный цикл ИИ‑триажа в своём security‑гейте — 80% входных токенов из кэша, ≈ 61% экономии. По пути нашёл 4 реа…
Тот самый харнесс который мы заслужили в эпоху, когда безопасность ИИ уже не диковинка
Если запустить любую передовую языковую модель из коробки и попросить ее провести тестирование безопасности агентной системы или собрать актуальный…
FastAPI accepts a `response_model` on streaming routes and silently ignores it
It builds the model. It registers it in the OpenAPI schema components. It never applies it. Your private fields go out on the wire. Affects FastAPI…
Five findings in FastAPI, and what happened when I reported them
An introduction to a short series. Four of the five are still live in the current release, and each post carries a reproduction you can run. I use F…
A text message that runs a command: OS command injection in Gammu SMSD (GHSA-9vjj-v46c-c5qf)
TL;DR What: Gammu SMSD — the daemon behind a huge number of SMS gateways, alerting rigs and 2FA senders — runs an operator-configured hook every tim…
They scoped the customer and forgot the customer's ledger — a High-severity cross-tenant BOLA in Open Food Network
TL;DR What: POST /api/v1/customer_account_transaction in Open Food Network authorized against the class , not the record. It took customer_id straig…
Confronting Vault Sprawl And The Risks It Brings
Modern enterprises do not set out to create a maze of credentials, keys, and secrets stores. However, this is the reality most organizations find th…
Running Snyk on Real Legacy Java Code — The Full Unfiltered Results
Numbers are easy to skim. 10 Critical. 99 High. 59 Medium. 20 Low. 188 total. Those numbers appeared in the first article and they're striking — but…
I shipped an unauthenticated RCE in my own port scanner — here's the whole chain, and how I killed it
I built a web front end for an Nmap-based port scanner: a FastAPI backend, a React dashboard, background scan jobs, a plugin system, the works. It r…
Роадмап по информационной безопасности
Цивилизация... Какие у вас ассоциации с этим словом? А если написать его по-другому, например, на английском. Вот так - Civilization... Ядерный Ганд…
Agentic AI Security: Risks, OWASP Agentic Top 10, and Defensive Patterns (2026)
Agentic AI applications — LLM-powered systems that take autonomous action against external tools, services, and APIs based on model reasoning rather…
Agentjacking: How Fake Bug Reports Are Hijacking AI Coding Agents — and How to Stop It
AI coding agents can't tell the difference between a legitimate bug report and one with hidden instructions buried inside it. That gap is now being…
282 AI Apps Are Handing Strangers Your API Bill — And Calling It a Product
The App Store Has an API Key Problem and "Move Fast" Culture Is to Blame Sixty-three percent of iOS AI chatbot apps studied are leaking secrets in n…
Mobile App Authentication: Best Practices for iOS and Android Developers (2026)
The mobile app authentication best practices question is the single hardest one to answer well in mobile application security, because the answers t…
Я нанял себе AI-пентестера: как LLM помогают мне искать уязвимости быстрее
Привет, друзья! Сегодня хочу поговорить об одной из самых обсуждаемых тем последних лет — использовании AI в пентесте. За последние два года вокруг…
The Tool Found Corridor Nodes — But the Bigger Finding Was Where It Found None
A few weeks ago I published corridor-lab — a Docker lab that proved a triage mismatch: a service that stores nothing sensitive can become high-prior…
DBD Cornucopia is now available to play online!
In development, we are used to understanding threat modelling as a structured method to make applications and other software secure. And in this, “s…
AI is shipping code faster than security was built to handle
AI coding tools have done something nobody planned for: they've made the security review cycle the bottleneck. Not CI. Not deployment. Security. Sny…
The Invisible Breach: Why Modern Web Frameworks Aren't Immune to LFI
Introduction: The Comfortable Lie There's a comfortable story developers tell themselves: "I'm using a modern framework. It handles all that low-lev…