Blog

Field notes on application security.

How-tos, research, and lessons on securing APIs, AI, and the modern application surface.

Bashar Abouseido, former Charles Schwab CISO, with the headline Hyper offense needs hyper defense.

October 28, 2026

Hyper Defense: Why Patching Faster Won't Stop AI-Speed Attacks

Former Charles Schwab CISO Bashar Abouseido explains why AI-driven attacks demand hyper defense, and why exploitability, not patch speed, sets priorities.

6 min

December 9, 2025

JWT Security Vulnerabilities: Prevention Guide & Best Practices

Identify and fix JWT vulnerabilities: algorithm confusion, weak secrets, and missing validation, practical hardening techniques with examples.

API Abuse Detection: Distinguish Good Bots from Bad Bots

December 9, 2025

API Abuse Detection: Distinguishing Between Bots

Distinguish malicious bots from legitimate automation on your APIs. Learn behavioral signals that separate good bots from bad bots attacking your endpoints.

How to Secure Webhook Endpoints: Authentication & Validation Guide

December 1, 2025

Securing Webhook Endpoints: Authentication and Validation Best Practices

Secure webhooks with HMAC, OAuth & payload validation. Step-by-step guide with testing checklist and common vulnerabilities.

Microservices API Security: Authentication & Authorization Guide

December 1, 2025

API Security in Microservices Architecture: Best Practices

Secure microservices APIs with mTLS authentication, zero trust authorization, service mesh, and secret management to stop lateral movement.

GraphQL Security Testing Guide: Vulnerabilities & Best Practices

December 1, 2025

GraphQL Security Testing: Complete Guide for Developers

Complete GraphQL security testing guide. Learn common vulnerabilities, penetration testing methods, and best practices for securing GraphQL APIs.

REST API Security Best Practices: 6 Essential Methods

December 1, 2025

REST API Security Best Practices Every Developer Should Know

Secure your REST APIs with 6 proven practices: strong authentication, authorisation, HTTPS encryption, input validation, rate limiting, and token management.

API Penetration Testing Checklist: 10 Critical Tests

December 1, 2025

Complete API Penetration Testing Checklist for Security Teams

Complete API pentesting checklist covering BOLA, broken authentication, BFLA, and more vulnerabilities. Get testing steps, tools, and real examples.

November 19, 2025

SSRF Explained: OWASP API Security Principle 7 Made Simple

Access control issues remain common in APIs. Continuous validation is essential as code and features evolve, making automated testing critical for long-term security.

Unrestricted access in APIs – OWASP API security principle 6 explained

November 19, 2025

Unrestricted Business Flows: OWASP Principle 6 Explained

APIs are often under-secured and over-permissioned. Hackers and regulators alike now highlight the growing risk of exposed APIs.

Understanding broken function-level authorization in APIs – vulnerability graphic

November 19, 2025

Instagram API Breach 2026: 17.5M Accounts & the Unrestricted Access Flaw

In Jan 2026, a 17.5M-user Instagram API breach exposed what happens when business flows go unchecked. Discover the flaw and how to prevent it.

BOLA vulnerability lessons – understanding broken object-level API authorization

November 19, 2025

BFLA Explained: Securing API Functions from Abuse

APIsec automates API discovery, OWASP testing, logic validation, AI-generated attacks, and CI/CD integration for modern engineering workflows.

Understanding BOPLA in APIs – broken object property-level authorization graphic

November 19, 2025

BOPLA (Broken Object Property Level Authorization): OWASP API3 Explained

BOPLA is OWASP API Security API3:2023. Learn how broken object property level authorization exposes sensitive data through API endpoints.