Blog

Field notes on application security.

How-tos, research, and lessons on securing APIs, AI, and the modern application surface.

Headline: Catch risky AI tools where they're written. A diagram shows an AI agent's path to payments passing through a human approval gate.

November 9, 2026

One Prompt Gave an AI Agent the Power to Move Money

A coding agent gave an AI support bot the power to issue refunds. See how Surface Code AI caught it in the session and what runtime testing must prove.

7 min

Perry Menezes, Cyber & AI Tech Risk and Advisory Exec, with the headline Answer the board's real question.

November 4, 2026

How to Build an AppSec Program with Claude, Then Govern It

Perry Menezes on using Claude in the AppSec program you already have: a five-step blueprint, exploitability over volume, and governing the AI agent.

Bashar Abouseido, former Charles Schwab CISO, with the headline Hyper offense needs hyper defense.

October 28, 2026

Hyper Defense: Why Patching Faster Won't Stop AI-Speed Attacks

Former Charles Schwab CISO Bashar Abouseido explains why AI-driven attacks demand hyper defense, and why exploitability, not patch speed, sets priorities.

NoSQL Injection in APIs: Detection & Prevention

March 25, 2026

NoSQL Injection in APIs: Detection and Prevention

How to detect and prevent NoSQL injection in APIs with MongoDB examples, operator payloads, and secure code fixes.

SQL Injection in APIs: Testing & Prevention

March 24, 2026

SQL Injection in APIs: Testing, Exploitation, and Prevention

How to test and prevent SQL injection in APIs with code examples, WAF bypass techniques, and proven defense strategies.

March 23, 2026

SQL Injection Cheat Sheet for API Security Testing

SQL injection targets APIs through JSON bodies, query params, and headers. Get API-specific payloads, code fixes, and a testing checklist.

March 9, 2026

HTTP Request Smuggling in API Gateways

HTTP request smuggling lets attackers bypass API gateway security controls. See API-specific attack types, real CVEs, payloads, and prevention strategies.

API Access Control Vulnerabilities: Testing Guide

March 9, 2026

API Access Control Vulnerabilities: Complete Testing Guide

Broken access control is the #1 API risk. See API-specific examples of BOLA and BFLA, testing methods, real breaches, and proven prevention strategies.

March 9, 2026

Insecure Deserialization in APIs: Complete Guide

Insecure deserialization lets attackers execute code through API endpoints. See how deserialization attacks work, real CVEs, and proven prevention strategies.

March 4, 2026

Race Condition Vulnerabilities in APIs

Race condition vulnerabilities let attackers exploit timing gaps in API logic. See real attack patterns, code examples, and proven prevention strategies.

March 5, 2026

Path Traversal in APIs: Detection and Prevention

Path traversal attacks let hackers read sensitive server files through API endpoints. See API-specific examples, payloads, and prevention strategies.

February 9, 2026

Top API Discovery Tools

Compare top API discovery tools that find shadow APIs, zombie endpoints, and hidden vulnerabilities across your environment.

Manual vs Automated Penetration Testing for APIs | What Works in 2026

February 9, 2026

Manual Penetration Testing vs Automated API Security

Manual pentesting vs automated API security: compare which approach protects modern APIs. Analyze speed, coverage, and cost to secure your endpoints effectively.