See what’s exploitable

Blog

Field notes on application security.

How-tos, research, and lessons on securing APIs, AI, and the modern application surface.

Bashar Abouseido, former Charles Schwab CISO, with the headline Hyper offense needs hyper defense.

October 28, 2026

Hyper Defense: Why Patching Faster Won't Stop AI-Speed Attacks

Former Charles Schwab CISO Bashar Abouseido explains why AI-driven attacks demand hyper defense, and why exploitability, not patch speed, sets priorities.

6 min

API Sprawl Management Strategies

February 5, 2026

API Sprawl Management Strategies

What API sprawl is, why 48% of organizations call it their top challenge, and proven strategies to manage, secure, and optimize your growing API ecosystem.

Zombie API Detection and Removal: Eliminate Hidden Risks

February 3, 2026

Zombie API Detection and Removal

How to detect zombie APIs through automated discovery and remove deprecated endpoints safely without breaking integrations.

How to Automate API Discovery with Extensions

January 13, 2026

How to Automate API Discovery with Extensions

Automate API discovery using browser extensions and scanning tools. Build real-time inventories and secure shadow APIs.

What Is an API Call? How API Requests Work

January 13, 2026

What Is an API Call?

API calls let applications exchange data and trigger actions. Learn how requests work, HTTP methods, authentication, security risks, and best practices.

Build Your API Inventory Automatically | APIsec

January 12, 2026

Build Your API Inventory Automatically as You Browse

Manual API tracking fails. Automatic discovery builds complete inventories in real time, eliminating shadow APIs and security blind spots.

OAuth 2.0 Common Security Flaws and Prevention Techniques

December 24, 2025

OAuth 2.0 Common Security Flaws and Prevention Techniques

Prevent OAuth vulnerabilities, including redirect URI attacks, PKCE bypasses, and token theft with proven security techniques.

API Rate Limiting Strategies: Preventing DDoS and Resource Exhaustion

December 24, 2025

API Rate Limiting Strategies: Preventing DDoS and Resource Exhaustion

Protect APIs from DDoS and resource exhaustion with rate limiting strategies, including token bucket and sliding window algorithms.

Open Source vs Commercial API Security Scanners Compared

December 24, 2025

Open Source vs Commercial API Security Scanners Compared

Compare open source and commercial API security scanners. Choose the right tool based on features, automation, and business logic testing.

Financial API Security Compliance: PCI DSS & PSD2

December 23, 2025

Financial Services API Security Compliance Guide

Master PCI DSS, PSD2, and fintech API security compliance with practical controls, testing strategies, and regulatory requirements.

API Security Automation Tools for DevOps

December 23, 2025

API Security Automation Tools and Techniques for DevOps Teams

Integrate automated API security testing into CI/CD pipelines with tools and techniques that catch vulnerabilities before deployment.

How to Automate API Security Testing in CI/CD

December 12, 2025

How to Implement Automated API Security Testing in Development Workflows

Step-by-step guide to implement automated API security testing in CI/CD pipelines. Integrate security testing into development workflows effectively.

API Security Testing for Payment Gateways: PSD2 & Open Banking Compliance Guide

December 9, 2025

API Security Testing for Payment Systems: PSD2 and Open Banking Requirements

Test payment gateway APIs for PSD2 compliance and Open Banking security. Complete checklist for authentication and transaction verification.