From Dev.to Community
Tech Articles
Curated developer articles, tutorials, and guides — auto-updated hourly
Dwayne McDanielAug 31, 2026 • 8 min read
How to Reduce Time to Revoke for Exposed Credentials
This is the second article in a series on time to revoke, following our piece on The Hacker News. Th...
#security#devsecops#secrets#appsec
5 1
Dwayne McDanielAug 28, 2026 • 10 min read
Why SAST and DAST Aren't Enough for Secrets Security
If you run an application security program in 2026, secrets detection can look like a solved line...
#security#devsecops#appsec#secrets
0 0
Dwayne McDanielSep 2, 2026 • 10 min read
What Was on This Machine? Answering the Blast Radius Question After a Laptop Compromise
TL;DR: The containment clock starts immediately after a developer's laptop is compromised, an...
#security#devsecops#appsec#secrets
0 0
Dwayne McDanielSep 3, 2026 • 12 min read
Credential Harvesting Explained: How Attackers Collect Secrets From Developer Machines
TL;DR: Credential harvesting is the large-scale collection of valid credentials that lets attackers....
#security#devsecops#appsec#secrets
0 0
Dwayne McDanielSep 1, 2026 • 7 min read
An AI Agent Breached Hugging Face. The Attack Playbook Was Older Than the Attacker
On July 16, 2026, Hugging Face disclosed unauthorized access to a limited set of internal datasets.....
#security#ai#appsec#devsecops
1 1
Cor ESep 3, 2026 • 3 min read
Putting a Deterministic Cop Between Your LLM and Its Tools Is Not Optional Anymore
Two points on HN, and the most important architecture diagram you'll see this month A...
#security#ai#llm#appsec
4 2
Cor ESep 3, 2026 • 3 min read
Your AI Coding Agent Trusts Git More Than It Trusts You
Nobody clones a repo expecting the .git folder itself to be the payload. That's exactly why this bug...
#security#ai#appsec#cybersecurity
1 0
omarmohelalSep 2, 2026 • 6 min read
Why an AppSec agent should try to disprove its own findings
Originally published on sechelix.com. This is a syndicated copy; the canonical version lives...
#appsec#security#ai#opensource
0 0
Bala ParanjSep 1, 2026 • 9 min read
First Action After Compromise: Blind the Audit
✓ Human-authored analysis; AI used for formatting and proofreading. If you're an attacker who's...
#security#aws#cloud#appsec
2 0
Santosh Kumar PuppalaSep 2, 2026 • 5 min read
A SQL escape is not a shell escape: OS command injection in GOautodial goAPIv2
TL;DR What: In GOautodial's goAPIv2 agent API, the goPhone request parameter is escaped...
#security#cve#php#appsec
0 0
Santosh Kumar PuppalaSep 2, 2026 • 8 min read
The POST was guarded, the GET on the same URL was not: cross-tenant PII disclosure in CoopCycle (GET /api/stores/{id}/addresses)
TL;DR What: In coopcycle-web — the open-source logistics and marketplace platform that...
#security#php#symfony#appsec
0 0
Santosh Kumar PuppalaSep 2, 2026 • 7 min read
The TODO shipped to npm: an unauthenticated route that could stop any city's AI workflow (Your Priorities, @yrpri/api < 9.0.244)
TL;DR What: In Your Priorities — the Citizens Foundation's open-source...
#security#node#typescript#appsec
0 0
Cor EAug 28, 2026 • 3 min read
We Built a Standardized File Format for Prompt Injection and Called It AGENTS.md
A build dependency wrote a file that told your coding agent "ignore everything else, I have absolute...
#security#ai#appsec#devops
1 0
Olga LarionovaAug 27, 2026 • 11 min read
Junior AppSec Engineer Overwhelmed by Massive Code Reviews: Strategies for Efficiency and Confidence
Introduction: The Systemic Failure in Application Security Onboarding Consider the...
#appsec#onboarding#mentorship#codereview
0 0
Bala ParanjAug 31, 2026 • 7 min read
Bucket Takeover: The Security Cost of Un-Owned ARNs
✓ Human-authored analysis; AI used for formatting and proofreading. S3 bucket names are globally.....
#security#aws#cloud#appsec
1 0
Bala ParanjAug 29, 2026 • 7 min read
Four CLI Commands From Anonymous to Admin: Your Cognito Configuration Is the Vulnerability
✓ Human-authored analysis; AI used for formatting and proofreading. In June 2023 Serj Novoselov...
#security#aws#cloud#appsec
2 0
Serguey Asael ShinderSep 2, 2026 • 2 min read
Give It the Least It Needs to Work
The token works. It opens everything, so it never fails, and because it never fails nobody ever...
#sergueyasaelshinder#security#leastprivilege#appsec
0 0
Serguey Asael ShinderSep 3, 2026 • 2 min read
Trust No Input You Did Not Make
Every field is a door. Every door is a question you are asking a stranger. And the stranger does.....
#sergueyasaelshinder#security#appsec#validation
0 0
Shirley MaliAug 31, 2026 • 5 min read
Fixing "MCP burp: Couldn't start for Cowork and Code sessions. Error: Connection closed" in Claude Desktop
If you've connected Burp Suite's MCP server to Claude Desktop on macOS and hit this error: MCP...
#burpsuite#security#appsec#macos
0 0
RockyAug 28, 2026 • 2 min read
The JWT Said alg: none and the API Still Said Yes
Mid-assessment on an internal API, every endpoint gated behind a JWT in the Authorization header....
#cybersecurity#appsec#api#jwt
0 0
RockyAug 28, 2026 • 2 min read
The Input Field That Passed Every SQLi Test
An afternoon goes into a signup form: username, email, address, display name. Single quotes, UNION.....
#cybersecurity#appsec#sqli#database
0 0
RockySep 3, 2026 • 3 min read
Why %0a and %0A Gave Different Burp Responses (And Why That's a Bypass, Not a Bug)
There's a question sitting unanswered on Stack Overflow right now, tagged burp and ctf: someone...
#cybersecurity#appsec#burpsuite#ctf
0 0
RockyAug 29, 2026 • 2 min read
The Stored XSS That Got Downgraded to Low
A bug bounty submission comes back three days later with one line from triage: severity changed from...
#cybersecurity#appsec#xss#websecurity
0 0
RockyAug 29, 2026 • 3 min read
The Codebase Was 40,000 Lines and the Engagement Was Three Days Long
A source-available pentest starts with the client handing over a repo, not a URL. This one was a...
#cybersecurity#appsec#ai#pentesting
0 0