Author
Jason Miller
5 min read
Your API Keys Are on GitHub Right Now. Here's How Attackers Find Them.
You opened Cursor, told the AI to build you a Stripe-integrated SaaS app, and twenty minutes later you had something that worked. You pushed it to GitHub.…
5 min read
The 'No Exploit, No Report' Philosophy: How Axeploit Eliminates False Positives Through Verified PoCs
Open a vulnerability report from most security tools and you will find a list of things that could be problems. A server header that matches a CVE.…
6 min read
Penetration Testing Types: Match the Test to What Your Organization Actually Needs to Prove
"Pentest" is a bucket label. Under it sit several different exercises, each designed to answer a different question. If you buy the wrong shape of test, you.…
4 min read
Why Your Subdomains Are a Goldmine for Attackers (And How We’re Fixing It)
Your main application might be locked down tight, but what about dev.company.com or blog.company.com? Subdomain scanning (often called subdomain enumeration).…
4 min read
Session IDs in Cookies: The Default That Only Stays Safe If You Ignore the URL
On most modern stacks, the session identifier lives in an HTTP cookie by default. That is a reasonable default. A cookie can be marked HttpOnly so JavaScript.…
5 min read
Your Users Can See Each Other's Data. No Scanner Will Tell You.
You built a dashboard. Each user has a profile at /api/users/42/profile. User 42 logs in, sees their name, email, billing history. Everything works.…
5 min read
The Hidden Security Debt of High-Velocity AI Development
High-velocity development often referred to as "vibe coding" leverages tools like Cursor and LLM-assisted workflows to push innovation at unprecedented speeds.…