This week: Security problems aren’t changing very much even though security teams are. Catching up on implications of the Claude Code source leak, the very human lessons from the axios NPM compromise, and secure design that involves agents, humans, or both. www.scworld.com/podcast-epis...

March meandered through C code, mused about secure design, marked a new top ten list, made space for machines, and finally descended into a bit of madness. And every single bit of it was fun! dangerouserrors.com/posts/2026-0...

Here’s the March recap while I finish writing up what we did in April. #appsec dangerouserrors.com/appsec/2025/...

At the end of every episode I mention a favorite #synthwave track. Because music makes everything better, even #appsec. And since it’s @bandcamp.com Friday, you can make a musician’s day better by supporting their work and grabbing a track (or two or three). dangerouserrors.com/synthwave-sh...

It’s @bandcamp.com Friday, which is an excellent Friday for supporting musicians. Buy a track. Buy an album. Enjoy some new music. And if you like #synthwave (and adjacent) tunes, check out this list for a few ideas. dangerouserrors.com/synthwave-sh...

Find more episodes, recaps, and some random #appsec reading on the blog. dangerouserrors.com

Getting ready to sneak in as many D&D references as possible into an #appsec discussion

@jwo3.bsky.social and I were guests on @aswpodcast.bsky.social this week, talking about WAF, protecting LLMs, breach trends, and software supply chain. Thanks, @mutantzombie.bsky.social for having us! www.scworld.com/podcast-segm...

We were somewhere around Barstow, on the edge of AppSec, when the vibe coding began to take hold.

One of my goals this year is to figure out a cost-benefit analysis of fuzzing vs. LLMs vs. grep. Later on in this episode Keith Hoodlet shared where he's seeing (and not seeing) #appsec potential from LLMs. Articles and episode at www.scworld.com/podcast-epis... youtu.be/zn3LT4BqOJo?...

Historical context for the "BadSeek" post by Shrivu Shankar (blog.sshh.io/p/how-to-bac...). He tweaked model weights to subtly introduce a backdoor into generated code, regardless of prompt, and noted the difficultly in detecting such manipulation. youtube.com/shorts/nB_KK...

Memory safe code was having an unsafe design week this week. News articles and notes at www.scworld.com/podcast-epis... www.youtube.com/watch?featur...

Sure, LLMs are helping devs write code, but is it secure code? How are LLMs helping #appsec teams? Keith Hoodlet returned to talk about those questions and put the capabilities of LLMs into perspective. Show notes at www.scworld.com/podcast-epis... youtu.be/zn3LT4BqOJo?...

There's no better place to discover the impact of logic flaws than in the cryptocurrency space, where every token is its own self-funding bug bounty and every contract is a gamble in correctness. Show notes: www.scworld.com/podcast-epis... youtu.be/0GlIbGgi1OY?...

Find episodes, recaps, and some random #appsec thoughts on the blog. deadliestwebattacks.com

From Skype's embrace of e2ee to the recent Wallbleed research against the GFW, there are tons of reasons why #appsec is not a myopic technical topic. It reminds me of an old joke about oversimplifying models. We shouldn't treat appsec as a spherical CVE in a vacuum. youtu.be/Cbzthj0s44I?...

CISA has been pushing for more software to be secure by design and secure by default. Jack Cable shares how CISA chose to frame their Secure by Design principles and encourage businesses to improve their software quality. Show notes at www.scworld.com/podcast-epis... youtu.be/fjc2zqEFcAI?...

I’ll be hosting the Qualys Cyber Risk Series: AppSec Edition tomorrow at 9am PT! Join me and experts in the #AppSec and #APISecurity space as we discuss the latest trends, threats, and techniques to stay ahead. Register now: qualys.brighttalk.com?utm_source=i... #Qualys #CyberRiskSeries

Your operating system has curl on it. Your toaster probably has curl on it. The moon likely will have curl on it soon. And you can't spell curl without C... @daniel.haxx.se explains how curl keeps its code secure and some of the #appsec friction it has had to deal. youtu.be/0UavY_kKKic

*shakes fist* It has been 0 weeks since we did not mention AI and LLMs. But I think we added helpful angles to what a secure architecture can look like for using them and what the implications are for backdoors like BadSeek. Show notes at www.scworld.com/podcast-epis... youtu.be/TIxLvtCT-CE?...

I love the "cookie sandwich" because it combines parsing, implementation mismatches, and finding new flaws in old (yet pervasive) tech. In our chat about the top 10 web hacking techniques of 2024, James talked about cookies and finding inspiration for research topics. youtu.be/8XEK3NkbKOA?...

For me, prompt injection is the new XSS. The techniques and payloads are fun, they inspire creative thinking, but they're ultimately a lot of noise to be filtered with an effective framework like the examples we mentioned here. Show notes: www.scworld.com/podcast-epis... youtu.be/TIxLvtCT-CE

We're almost at 20 years of celebrating web hacking techniques. @jameskettle.com shares his favorites from 2024, the list's importance to the web hacking community, and what inspires the kind of research it highlights. List at portswigger.net/research/top... youtu.be/8XEK3NkbKOA?...

Scott Norberg's goal for pentesting really resonated with me. "I view it as my job not to find all the instances of three different classes of vulnerabilities; it's to find as many different classes of vulnerabilities as I can." www.youtube.com/clip/Ugkx0N9...

Kalyani and I reviewed the "unforgivable" criteria in the recent article from @ncsc.gov.uk. We applied it to vulns in the news, with some easy ones like DeepSeek disabling ATS on iOS. But then the categories get messier... Show notes: www.scworld.com/podcast-epis... youtu.be/AVkucIviAnI?...

Code scanning is an ancient #appsec practice. Grep and regexes still work, but grep can't follow control flows and regexes aren't semantic parsers. Scott Norberg talks about his experience looking for a scanner against .NET code and why he ended up writing his own. www.scworld.com/podcast-epis...

We had a busy January! And getting ready to record once again this Monday. deadliestwebattacks.com/appsec/2025/...

A brief clip from our discussion: www.youtube.com/clip/Ugkx3J9...

We've come a long way from the two question threat model that never worked for #appsec in the first place: - What are you building? - Did you complete the checklist I gave you?

I chatted with @mutantzombie.bsky.social on the @aswpodcast.bsky.social about application threat modeling trends and some of the things that surprised me the most when I dug into best practices. www.youtube.com/watch?v=HZpm...

First, a bit about the Semgrep/Opengrep fork, with a nod to Nessus/OpenVAS similarities from 2005. Then tasted a Cookie sandwich attack, facepalmed at dead simple Subaru vulns, and cheered the pure geeky joy of getting an RCE on a synth via MIDI messages. Notes at www.scworld.com/podcast-segm...

Niv Braun explains #appsec approaches to securing the AI-specific and AI-related parts creating genAI and ML apps. He breaks down three ways the AI SDLC is different, while making sure we don't lose focus on the security basics of hardening an SDLC. youtu.be/lEn359SKK40

Episode recap for December 2024 -- observability, a year in review and creating secure defaults deadliestwebattacks.com/appsec/2025/...

I would have noted how Neal Stephenson named and conceived the metaverse, but that concept still remains fiction... Anyway, here's a brief post on "Shockwave Rider". deadliestwebattacks.com/books/2010/1...

Of course, I had to mention William Gibson's concept and description of cyberspace from the 80s. It influenced a lot of early infosec attitudes and practitioners. Cyberpunk was always a mix of politics and aesthetics.

This was about #appsec predictions for 2025, but my intro dipped into the past. I love sci-fi in all forms and wanted to reach back to the origin of some of the familiar terms we have today. I gave a nod to John Brunner's "Shockwave Rider", which back in 1975 coined and described a computer worm.

What will be meaningfully different in 2025 for #appsec? Cody Scott talked about a pullback on appsec budgets for genAI as it searches for value. Coding assistants clearly impact how devs build apps, but appsec assistance still seems more promise than practicality. www.scworld.com/podcast-epis...

This is a good explanation of the not-new "Learn from this app" that provides a helpful history of the feature, how it's still grounded in privacy-friendly design, and the challenges in countering misunderstandings when people discover a feature that's new to them. www.intego.com/mac-security...

I've been wanting to chat with more devs about the #appsec experience. Ixchel Ruiz talked about software quality and design requirements, including the difference between actionable requirements and over-simplified "create secure code". Notes: www.scworld.com/podcast-epis... youtu.be/BehTGCuzEO8

We kicked off 2025 on the origins of DefectDojo and the need for #appsec tools to deliver value. Quality and low false positives are table stakes -- it's more important to understand whether a tool or process is useful, let alone having a desired impact on risk. www.scworld.com/podcast-epis...

Enjoyed talking to the @aswpodcast.bsky.social team about security and design choices and a whole lot more. Enjoy this 2023 throwback: www.scworld.com/podcast-segm...

Do you remember what you were doing 9,039 days ago? We covered curl's newly discovered most ancient bug, noting that #appsec needs more than memory safety. Moving to Rust is a great start, but many more types of flaws remain. Show notes at www.scworld.com/podcast-segm... youtu.be/6ocFzjANthg?...

Our #appsec chat with Hannah Sutor started with credential management for non-human identities, but her product management focus quickly turned to usability and making secure defaults work for users. Show notes: www.scworld.com/podcast-epis... See you all in 2025! youtu.be/Aev4Mcngpsg

We’d love to have you back in 2025, even if it means our hosting bills will go up.

Just recorded the last episode of 2024. This December we talked observability, identity, and an #appsec review from AI to XZ Utils. In December 2023 we talked LLMs and Rust, service meshes, and standards. Check out last year's recap below. Now on to 2025! deadliestwebattacks.com/appsec/2024/...

From using AI to find vulns to finding a backdoor in XZ Utils, it was an eventful #appsec year. @jlk.bsky.social and I looked back on some OWASP projects, where AI seems to be headed, and what we hope to see in 2025. Show notes at www.scworld.com/podcast-epis... youtu.be/GYJ3fwZ_G8A?...

Get the latest on @zaproxy.bsky.social's future from @psiinon.bsky.social & Ori Bendet via SC Magazine and Application Security Weekly podcast #AppSec #WebAppSec #DAST #PenTesting #DevSecOps #RedTeam www.scworld.com/podcast-segm...

Hey kids! Check me out on Application Security Weekly, talking about my fave topics, #Observability and #OpenTelemetry!

In a season with songs about checking lists twice, it seems topical to talk about observability. Adriana Villela shared her work with OpenTelemetry and her advice in helping dev teams add and improve the observability of their systems. Show notes at www.scworld.com/podcast-epis...