Our recent post explores the unpredictability of Java garbage collection and the implications that has for secrets in code. blog.includesecurity.com/2025/11/immu...

In our latest post we look under the hood of a professional-grade audio mixer to explore its security profile and consider how vulnerabilities could be leveraged by an attacker in a real world setting. blog.includesecurity.com/2025/10/prod...

Developers should consider how implementing LLMs into an application affects its attack surface. Likewise, pentesters assessing those applications should scope the test with that attack surface in mind. Our latest post covers both perspectives! blog.includesecurity.com/2025/07/llms...

Our most recent post covers various ways pentest reports are misinterpreted, including why findings aren't a sign of failure and why "clean" reports may not indicate a good security posture. blog.includesecurity.com/2025/05/misi...

Do you use WebSockets? Read our latest blog post to find out how modern browsers may (or may not) be protecting you from Cross-Site WebSocket Hijacking. blog.includesecurity.com/2025/04/cros...

Today our team at IncludeSec is releasing a small website to help those concerned with key collisions. This easy site allows you to check if your private keys have been found to be public! ismyprivatekeypublic.com Please pass along to your industry colleagues who might need such a site today 💓 🦾

Hi all, check out our latest blog post on Delphi memory corruption vulnerabilities! blog.includesecurity.com/2025/03/memo... We cover how compiler flags and dangerous system library routines could affect memory safety while demonstrating Delphi stack/heap-based overflow examples.