Blog
How-tos, research, and lessons on securing APIs, AI, and the modern application surface.
November 12, 2026
apisec vs Bright Security: Bright validates code in the AI coding loop. apisec proves what an attacker can exploit across every application.
8 min
apisec vs Invicti: Invicti proves common web flaws with safe exploits. apisec proves what an attacker can do across your whole application.
apisec vs 42Crunch: 42Crunch tests APIs against their OpenAPI contract. apisec proves what an attacker can exploit, with or without a contract.
How apisec compares with Checkmarx, Snyk, Veracode and Black Duck: they find possible flaws in code; apisec proves which ones attackers can exploit.
November 10, 2026
apisec vs Black Duck: Black Duck finds flaws in code and open source, then fixes them. apisec proves which ones an attacker can exploit in the live app.
October 31, 2026
apisec vs Snyk: Snyk finds flaws in code and works to fix the whole backlog. apisec proves which ones an attacker can exploit, with or without source.
September 30, 2026
apisec vs Checkmarx: Checkmarx finds possible flaws in code and dependencies. apisec proves which ones an attacker can exploit in the live app.
July 31, 2026
apisec vs Veracode: Veracode finds possible flaws in code and dependencies. apisec proves which ones an attacker can exploit in the running application.
Sterling Chin on why coding agents never ask for context, why a check that can't fail isn't a check, and how to deliver, confirm and test what agents know.
November 9, 2026
A coding agent gave an AI support bot the power to issue refunds. See how Surface Code AI caught it in the session and what runtime testing must prove.
November 4, 2026
Perry Menezes on using Claude in the AppSec program you already have: a five-step blueprint, exploitability over volume, and governing the AI agent.
October 28, 2026
Former Charles Schwab CISO Bashar Abouseido explains why AI-driven attacks demand hyper defense, and why exploitability, not patch speed, sets priorities.
March 25, 2026
How to detect and prevent NoSQL injection in APIs with MongoDB examples, operator payloads, and secure code fixes.
