If you attended my vibe coding session at the @OWASP Community at @defcon (or you didn't but you are interested) and you want to continue the conversation, Emile Delcourt opened a dedicated channel on the @OWASP slack workspace: owasp.slack.com/arch...

About to head home after a packed week+ in Vegas for Hacker Summer Camp. Some highlights for me:

My searing hot take for today is that everyone hitting out at "security influencer" culture might want to consider that being able to persuade and influence is probably the most important tool in your security skillset.

Excited to be back delivering my course again at Black Hat USA!

The final two parts of my blog series about delivering training at conferences have now been released! You can check them out on the @BounceSecurity website now!

Pulled last year's class workbook out so that I can prepare the updated version for this year. You still have time to sign up for my updated course at @blackhatofficial.bsky.social #BHUSA, in person in Las Vegas, August 4-5.

So you have a great training course with super-cool interactivity, now you have to get it accepted. In my next blogpost, I talk about writing a proposal which appeals to both the review board and also your potential attendees. Check it out here: www.bouncesecurity.c...

Last week, I was honoured to received a Distinguished Lifetime Member award from OWASP at Global AppSec EU Barcelona 2025. I wrote more about it here: www.linkedin.com/pos...

So @ElarLang just published version 5.0.0 of OWASP ASVS, live on stage at @OWASP Global AppSec EU Barcelona 2025!

In October, 2021, we released 4.0.3 of the OWASP ASVS Standard. This release marked the start of the Vanilla Ice (or 5.0 as everyone else called it) release. A major rethink about how we use the standard and with feedback from the community.

Last week to save before prices go up on 23rd May! Unless you Accelerate your AppSec Programme, you are going to get left behind.. Join me @blackhatofficial.bsky.social #BHUSA this summer in Las Vegas (4-5 Aug) for a practical guide on how to build bridges with developers and build securely!

Welcome @blackhatofficial.bsky.social 🙂 You should probably report this account for impersonation though... bsky.app/profile/blac...

The #BHUSA Early Registration Rate ends May 23rd! Register today to lock-in the lowest rate before it increases. Register here >> bit.ly/4jnXIa5 #BHUSA #Cybersecurity

The #BHUSA 2025 Early Registration rate ends MAY 23! Secure your spot today at the lowest rates available>> bit.ly/4l9aYRH

Want to make your security training course memorable? 🎯 My latest post dives into creative ways to get students' hands dirty, from cloud-hosted labs to simulated stakeholder exercises. Learn how to make practical exercises the highlight of your course, not just an afterthought.

My blog series on developing training courses continues with a post about how to find the topic you are passionate about and that will also attract attendees: www.bouncesecurity.c...

The bat-shit insane stories coming out of the US government this week is quite something

So, you've decided you want to deliver training courses at a conference? In the next post in my series about my experiences, I want to talk about money. I don't think it should be your main motivation but you probably can't ignore it! Check it out: www.bouncesecurity.c...

You can find out details in our contribution guide: github.com/OWASP/ASV... Alternatively, get in contact with us via OWASP Slack: owasp.slack.com/arch... Have your say now! Submit early to avoid disappointment 😀 2/2

📯YOUR INPUT IS NEEDED!📯 @OWASP ASVS version 5.0 release candidate is ready for review. The final version is planned for the end of May. We want your feedback before then! Can devs understand it? How about testers? Anything missing? Dive into GitHub and let us know! 1/2

I will be publishing the next post in this series tomorrow so look out for it!

This year should hopefully be the 3rd year that I train at @BlackHatEvents #BHUSA and also at @OWASP #AppSecEU? But how did I get to this stage? The short answer is a lot of thought and hard work. And the long answer? Well I thought I'd write some thoughts down... 🧵 1/x

🚀 Join Us as a Volunteer for OWASP AppSecIL!🚀 We’re gearing up for the OWASP Israel Conference in June 2025, and we need YOUR help to make it a success! If you’re passionate about cybersecurity, networking, and community-driven events, this is your chance to get involved. 1/5

This year should hopefully be the 3rd year that I train at @BlackHatEvents #BHUSA and also at @OWASP #AppSecEU? But how did I get to this stage? The short answer is a lot of thought and hard work. And the long answer? Well I thought I'd write some thoughts down... 🧵 1/x

For the third year running, I am going to be delivering application security training at both @OWASP #GlobalAppSec EU in Barcelona (26-27 May) and also @BlackHatEvents #BHUSA in Las Vegas (4-5 Aug) and I am super excited! Want to hear more? Keep reading... 1/5

For the third year running, I am going to be delivering application security training at both @OWASP #GlobalAppSec EU in Barcelona (26-27 May) and also @BlackHatEvents #BHUSA in Las Vegas (4-5 Aug) and I am super excited! Want to hear more? Keep reading... 1/5

Registration for #OWASP AppSec Israel 2025 is officially OPEN! Whether you're a developer, security engineer, or cybersecurity enthusiast, join us on June 5, 2025 for Israel’s premier application security event. 🎟️ Secure your spot now: appsecil2025.forms-w...#OWASP1/2

OWASP AppSecIL 2025 is looking for speakers to present cutting-edge research, real-world case studies, and innovative insights. Whether you’re a first-time speaker or a seasoned expert, we encourage you to share your knowledge and inspire the AppSec community. 1/2

The biggest AppSec conference in Israel is just around the corner, and we're excited to welcome you! Mark your calendars and stay tuned—registration details will be available soon. 📅 Date: June 5, 2025 📍 Location: Tel Aviv Expo – Pavilion 10 🎟 Registration link coming soon

Hi @mvsamuel.bsky.social, did you ever finish this story? Looks like it finishes half-way through... dev.to/mikesamuel/2...

If you want to find the finest vulnerabilities, look for the feature that was considered a critical delivery from a business perspective and was therefore rushed out super fast...

5. Applied Cryptography – Real-world applications, vulnerabilities, and protections 6. Bug Bounty Stories, Fun Hacks & Creative Exploits – Unique perspectives, social engineering, and more 📅 CFP Deadline: March 15, 2025 🔗 Submit now: www.papercall.io/owa... 5/6

💡Want to speak at Israel’s top application security event? Now’s your chance! OWASP AppSec Israel 2025 is looking for speakers to present cutting-edge research, real-world case studies, and innovative insights into Application Security. 1/6

What fresh hell is this!!! And where is my Right-Ctrl!!!

Inspired by @sethlaw.bsky.social on the @absoluteappsec.bsky.social podcast... Eliminate entire classes of vulnerabilities in your app by learning which findings from your SAST are always nonsense and ignoring them...

I wrote a blog for AppSec practitioners about how you gather information about what is going on in the development organization. Some of it is more relevant when contracting but a lot of it is relevant to internal people as well.

Attention 3rd party library risk experts! On a scale of 1 to 10, how high would you rate the risk for: "library is hosted on SourceForge" Is the library considered "end of life"? Never mind that, is the platform which hosts it considered "end of life"....?!?!?

Hi folks, we are considering replacing the current tick boxes which indicate the level of a requirement with a simple number. In the short term we will change markdown files but leave the output formats the same. Can anyone think of a good reason why we should not do this?

Idle thought. @Semgrep OSS/CE is licensed LGPL which means you can pretty much use it however you like BUT if you change the code, you have to open source the changes with LGPL. 1/3

Apparently moving blogging platform on the same day as publishing a popular blog post was not a smart move by me...

If you were looking for a comprehensive update and clarification on what has happened with @Semgrep and @opengrep so far, I wrote up a post about it. There are some nuances that got lost in this story but overall I think this is a positive thing for the Semgrep engine.

What I should have done this morning: Published my 6 page blog post about what's going on with @Opengrep and @Semgrep What I actually did this morning: Migrated my website, blog and all historic posts over to Jekyll 🤦‍♂️ I'll get there, I promise.

What I should have done this evening: Worked on the @asvs.owasp.org What I actually did this evening: Wrote a 6 page blog post about whats going on with @opengrep and @semgrep 🤦‍♂️ Look out for that tomorrow...

Seems like there's a bit of confusion around the recent @Semgrep licence change and the @opengrep fork and I think there are two key points to highlight. 1/10

Last night a developer merged code which included a new API endpoint without the standard authorization decorator. This morning, that exception popped up on my custom static scanning report which meant I could investigate. This afternoon, the fix was merged 😎

I'm going to be talking about the @OWASP_ASVS at @jit_io 's DevSecNext conference TONIGHT. Catch me in the back room upstairs at 18:15!

As an AppSec architect, you want to be sure that software is being built securely and be available to provide support and guidance. But how do you keep your finger on the pulse of what development is actually happening? Check out my blogpost about this😀 www.bouncesecurity.c...

I have a Windows VM that I rarely use and having booted it and done 45+ minutes of updates I think I now remember why... 1/2

As an AppSec architect, you want to be sure that software is being built securely and be available to provide support and guidance. But how do you keep your finger on the pulse of what development is actually happening? Check out my blogpost about this😀 www.bouncesecurity.c...

Lately, every BSides seems to have a talk on reframing security teams as a “Department of Yes” We don’t hear nearly as much about the value of a well-considered, strategically deployed “No” I've pulled together guidance on giving a better, more constructive No: ramimac.me/saying-no