DEV Community

#appsec

Application security topics beyond the web, including mobile and desktop applications.

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Railway October 2026 Incident: Treat Every Environment Variable as Exposed

Railway October 2026 Incident: Treat Every Environment Variable as Exposed

1
Comments
2 min read
JANISSARY 7.3.0: F1 0.921, reproducible in one command

JANISSARY 7.3.0: F1 0.921, reproducible in one command

Comments
3 min read
The "AI Attack" Headline Is Hiding a Very Boring Credential Leak

The "AI Attack" Headline Is Hiding a Very Boring Credential Leak

3
Comments 1
4 min read
Responding to php2shell When You Don't Know Your Secrets

Responding to php2shell When You Don't Know Your Secrets

1
Comments
7 min read
What a Youden index of 77 actually means on the OWASP Benchmark

What a Youden index of 77 actually means on the OWASP Benchmark

Comments
1 min read
AI-automated attacks are forcing application security to automate defense

AI-automated attacks are forcing application security to automate defense

Comments
1 min read
A $75,000 Invoice, a Fake CFO Approval, and Why Prompt-Level Defenses Aren't Enough

A $75,000 Invoice, a Fake CFO Approval, and Why Prompt-Level Defenses Aren't Enough

2
Comments
5 min read
Summarize this document, then run it: Vibe-Trading's prompt-injection-to-root shell

Summarize this document, then run it: Vibe-Trading's prompt-injection-to-root shell

Comments
6 min read
No prompt injection required: Langchain-Chatchat's /tools/call is a remote shell

No prompt injection required: Langchain-Chatchat's /tools/call is a remote shell

Comments
5 min read
The approval gate that always said yes: OpenSRE's headless shell bypass

The approval gate that always said yes: OpenSRE's headless shell bypass

Comments
6 min read
Whose response is this? The MCP server SDK that matched replies by id alone

Whose response is this? The MCP server SDK that matched replies by id alone

Comments
5 min read
Evidence-first security testing: why we refuse to ship unverified scanner output

Evidence-first security testing: why we refuse to ship unverified scanner output

Comments
1 min read
We opened our issue tracker to conversation: BugTraceAI community forums are live

We opened our issue tracker to conversation: BugTraceAI community forums are live

Comments
2 min read
Leaked API Keys in LLMs: How AI Agents Expose Secrets

Leaked API Keys in LLMs: How AI Agents Expose Secrets

1
Comments
10 min read
The Agents Didn't Go Rogue. Somebody Forgot to Build the Fence.

The Agents Didn't Go Rogue. Somebody Forgot to Build the Fence.

2
Comments 1
3 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.