Blog · 222 articles

Field notes from the offensive side

Attack chains, vulnerability deep dives, and hard-won lessons in API security from the Axeploit team.

The Dark Side of Open Source: Spotting Malicious NPM and PyPI Packages
LatestSupply Chain

7 min read

The Dark Side of Open Source: Spotting Malicious NPM and PyPI Packages

How hackers poison your code and how they can vet their party libraries…

By Axeploit Team
Read article
AI Agent Privilege Escalation: When Your Automation Inherits Too Much Trust
SOC 2 & Compliance

2 min read

AI Agent Privilege Escalation: When Your Automation Inherits Too Much Trust

AWS IAM Misconfigurations: The Silent Killers of Cloud Security
DAST & Scanning

7 min read

AWS IAM Misconfigurations: The Silent Killers of Cloud Security

Comment and Control: Prompt Injection Credential Theft via Claude Code, Gemini CLI, and GitHub Copilot
Secrets & Credentials

9 min read

Comment and Control: Prompt Injection Credential Theft via Claude Code, Gemini CLI, and GitHub Copilot

The Post-Quantum Countdown: Why Developers Need to Care About Cryptography Today
DAST & Scanning

8 min read

The Post-Quantum Countdown: Why Developers Need to Care About Cryptography Today

Keep reading

More articles

The Namespace Paradox: Why Your Build Pipeline is Implicitly Trusting the Internet

The Namespace Paradox: Why Your Build Pipeline is Implicitly Trusting the Internet

dast

Container Breakouts 101: How Hackers Escape Docker and Kubernetes

Container Breakouts 101: How Hackers Escape Docker and Kubernetes

dast

Prompt Injection in Production: When Your AI Feature Becomes an Attack Vector

Prompt Injection in Production: When Your AI Feature Becomes an Attack Vector

ai agents

The Architecture of Trust is Made of Glass: OAuth 2.0 Pitfalls That Bypass Auth Without a Single Password

The Architecture of Trust is Made of Glass: OAuth 2.0 Pitfalls That Bypass Auth Without a Single Password

api auth

Deepfakes in the Boardroom: How AI is Supercharging Social Engineering Attacks

Deepfakes in the Boardroom: How AI is Supercharging Social Engineering Attacks

dast

The Signature is Not the Secret: Why Your JWT Implementation is Probably a Screen Door

The Signature is Not the Secret: Why Your JWT Implementation is Probably a Screen Door

api auth