Blog

Field notes on application security.

How-tos, research, and lessons on securing APIs, AI, and the modern application surface.

Bashar Abouseido, former Charles Schwab CISO, with the headline Hyper offense needs hyper defense.

October 28, 2026

Hyper Defense: Why Patching Faster Won't Stop AI-Speed Attacks

Former Charles Schwab CISO Bashar Abouseido explains why AI-driven attacks demand hyper defense, and why exploitability, not patch speed, sets priorities.

6 min

NoSQL Injection in APIs: Detection & Prevention

March 25, 2026

NoSQL Injection in APIs: Detection and Prevention

How to detect and prevent NoSQL injection in APIs with MongoDB examples, operator payloads, and secure code fixes.

SQL Injection in APIs: Testing & Prevention

March 24, 2026

SQL Injection in APIs: Testing, Exploitation, and Prevention

How to test and prevent SQL injection in APIs with code examples, WAF bypass techniques, and proven defense strategies.

March 23, 2026

SQL Injection Cheat Sheet for API Security Testing

SQL injection targets APIs through JSON bodies, query params, and headers. Get API-specific payloads, code fixes, and a testing checklist.

March 9, 2026

HTTP Request Smuggling in API Gateways

HTTP request smuggling lets attackers bypass API gateway security controls. See API-specific attack types, real CVEs, payloads, and prevention strategies.

API Access Control Vulnerabilities: Testing Guide

March 9, 2026

API Access Control Vulnerabilities: Complete Testing Guide

Broken access control is the #1 API risk. See API-specific examples of BOLA and BFLA, testing methods, real breaches, and proven prevention strategies.

March 9, 2026

Insecure Deserialization in APIs: Complete Guide

Insecure deserialization lets attackers execute code through API endpoints. See how deserialization attacks work, real CVEs, and proven prevention strategies.

March 4, 2026

Race Condition Vulnerabilities in APIs

Race condition vulnerabilities let attackers exploit timing gaps in API logic. See real attack patterns, code examples, and proven prevention strategies.

March 5, 2026

Path Traversal in APIs: Detection and Prevention

Path traversal attacks let hackers read sensitive server files through API endpoints. See API-specific examples, payloads, and prevention strategies.

February 9, 2026

Top API Discovery Tools

Compare top API discovery tools that find shadow APIs, zombie endpoints, and hidden vulnerabilities across your environment.

Manual vs Automated Penetration Testing for APIs | What Works in 2026

February 9, 2026

Manual Penetration Testing vs Automated API Security

Manual pentesting vs automated API security: compare which approach protects modern APIs. Analyze speed, coverage, and cost to secure your endpoints effectively.

February 10, 2026

Difference Between API Security and Web Security

Compare API security and web security. Critical differences, unified protection strategies, and why modern apps need both for complete defense.

February 7, 2026

What Is API Discovery and Inventory?

What API discovery and inventory are, why they matter for security, and how to implement automated solutions to protect your complete API attack surface.