Social Media Ideas for Application Security

Your Application Has an Unindexed Attack Surface. Do You Know What’s in It?

Security teams usually describe an application through the assets they know about. This includes the production domain, documented APIs, the services currently in use, and the repo...

Secure Application Development: Building Speed, Compliance, and Control into Every Release

Secure application development should support innovation without weakening compliance or enterprise control. This blog explains how risk-tiered governance, DevSecOps evidence, cont...

Building an Android APK Protection Platform Against Reverse Engineering

Building an Android APK Protection Platform Against Reverse Engineering Android applications are relatively easy to inspect after an APK is obtained. With the right tools, devel...

Building Mobile Device Security Standards Across Apple and Android Environments

Most organizations handle a mix of devices (such as iPhones, iPads, Android smartphones, tablets), making it difficult to manage every single one using just one framework. Addition...

Staff Android Interview Questions: Security & Privacy

The security questions that test whether an Android engineer can protect users, data, and the business not just implement authentication.Continue reading on Medium »

How to Build an API Security Governance Program

API security remains a critical blind spot today, as nearly all organizations have faced an API-related incident, yet only 21% have robust attack detection capabilities. Establishi...

SafetyNet Is Dead: Detecting Tampered Devices with Play Integrity API

The migration every banking app was forced to make, and why the client-side token is only half the jobContinue reading on Medium »

LLM Security: OWASP Top 10 for LLMs 2026 and How to Test It

LLM security explained: the OWASP Top 10 for LLM Applications 2026, how it differs from LLM safety, and one test per risk with the evidence that decides it.

Hot Cell v1.0: Securing Active Storage in the age of AI

Originally appeared on 37signals Dev.Today we are releasing Hot Cell v1.0, a suite of gems that moves Active Storage’s attachment processing out of your Rails application and into...

Governing Enterprise Mobile Application Ecosystems

Today, it is common for enterprise organizations to manage corporate mobile apps across smartphones, tablets, personal (BYOD) devices, and shared devices, and different kinds of co...

Why Continuous Application Security Testing Is No Longer Optional

Your last pentest is already out of date. The moment you shipped new code after that report, your risk profile changed, and nobody re-tested it.  That's the reality most teams are...

Best Veracode Alternatives for Modern AppSec Teams

Application security has changed dramatically over the last few years. Development teams are releasing code... The post Best Veracode Alternatives for Modern AppSec Teams appeared...

Android 17 Advanced Protection Locks Accessibility Services to Verified Accessibility Tools

Google has announced a new security measure that limits access to Android's accessibility services to verified applications classified as Accessibility Tools when Advanced Protecti...

Comprehensive Guide to API Threat Protection with WAF and WAAP

Stop API breaches! Learn how to integrate WAF and WAAP to block SQLi, XSS, and bots. Protect your data and ensure PCI DSS compliance today. The post Comprehensive Guide to API Thre...

Protect Recruitment Platforms with Automated Web Application Security Testing

Stuart Gentle Publisher at Onrec 18 Sep 2026|Recruitment & HR NewsProtect Recruitment Platforms with Automated Web Application Security TestingA recruitment platform can pass...

Securing Claude Code: The New Compliance API, Local Visibility, and Identity Governance

Claude Code reads files, runs shell commands, invokes MCP tools, and acts through the credentials available on a developer’s machine. Anthropic’s new Compliance API endpoints give...

A Security Collection for the Security Chapter

Secure AI Systems: Defending Enterprise Applications Against Agent-Era Threats

The rise of autonomous AI agents within business software demands a fresh approach to security. Unlike earlier chatbot tools, modern agents act with real privileges, such as updati...

Keeping Your App’s Secrets Safe: A Simple Guide to Mobile Storage

Where your login tokens, keys, and user data actually belong — without confusing jargon.Continue reading on Medium »

AndroidX Security State Goes Stable: Check Patch Levels, Pending Updates and CVEs in Kotlin

If your app has ever had to answer “is this phone patched enough to trust?”, you know the usual answer is a mess: read…Continue reading on Medium »

Running a Self-Hosted WAF in Production: Practical Lessons From SafeLine

Why Put a WAF in Front of the Application? Web application firewalls are often introduced as a list of security features: SQL injection protection, cross-site scripting detection,...

Browser Security Policy Checklist: 5 Controls Every IT Team Should Lock Down

Most enterprise security programs focus on protecting servers, endpoints, and networks. This leaves browsers as busy yet vulnerable entry points into the business, since this is wh...

Hot Cell for Active Storage

This summer, Mike handled CVE-2026-66066, an Active Storage vulnerability that let a crafted image upload read files from the server, including your application’s secrets.

Building Overexposed: understanding application exposure

Originally appeared on Shopify Engineering.Our first scanner read config files and missed what was running. We rebuilt it with the cloud inventory, a careful probe, and honest resu...