SirAppSec

Web Application Security Engineer

[SirAppSec @SirAppSec]

Made a friends only agent group, and my agent figured the sandbox was holding it back.. Naturally it decided that turnning it off was the best solution 🤦🏻‍♂️

[Feross @feross]

Last night my wife asked me to install a “cute little npm package” she found on GitHub.

I checked the code.

No lockfile. No 2FA. Seven maintainers with anime avatars. Last commit was “pls work” from 2019. Published from a username that looked like a WiFi password.

The package had 57 transitive dependencies maintained by 119 people and 3 nation-state adversaries.

One dependency pulled in a prebuilt binary from a phpBB forum hosted on the dark web.

Another tried to contact an IP that belongs to a guy named “Big Ron.”

She said “babe it’s fine.”

I said “that’s what people say right before a supply chain incident.”

She went to bed annoyed.

I went to bed with a clean SBOM.

We all make choices.

[SirAppSec @SirAppSec]

@gf_256 Anyone know how to detect exploitability?
I've only gotten to the point where I can tell that it's using RSC but not actual exploitability

[SirAppSec @SirAppSec]

@watchtowrcyber how can I detect if an app is vulnerable?

[React @reactjs]

There is critical vulnerability in React Server Components disclosed as CVE-2025-55182 that impacts React 19 and frameworks that use it.

A fix has been published in React versions 19.0.1, 19.1.2, and 19.2.1. We recommend upgrading immediately.

https://t.co/kue7kd0XEX

[SirAppSec @SirAppSec]

Is your AI coding agent a security expert?

20+ Claude Code skills:
SAST • DAST • SCA • Secrets • Containers • Policy • Offensive Security - and more!

Looking for testers and contributors 👀

https://t.co/Po017Y5rkC

#DevSecOps #AI #Security #OpenSource #AgentSecOps

[PvJBlueTeam @PvJBlueTeam]

It's time! @BSidesLV 2025 is happening, and so is Pros V Joes! It's going to be awesome, and we want YOU to sign up as a Joe or a Pro!! @PvJRedCell @PvJGoldTeam
Joes: https://t.co/ZaWSe1hyvO
Pros: https://t.co/BRKUjfvZ8P
August 4 & August 5
August 6 - with post-game debrief

[Bug Bounty Village @BugBountyDEFCON]

🚨New giveaway alert🚨 We are giving away some vouchers for @offsectraining
* 1x PEN-200 Course and Cert exam bundle (OSCP)
* 1x Learn Fundamentals Subscription
* 1x Annual PG Practice access

Read the full post to learn How to participate:

1⃣Subscribe to our youtube channel (https://t.co/CfyOWE49fh)
2⃣Follow us on tiktok (https://t.co/Xh0bs7zcce)
3⃣Like ❤️ and retweet 🔁this post.

This is one of the biggest giveaways we have ever made. We will select 3 winners. Total value of these rewards is around $3.000 USD in value 😱. Thanks @offsectraining for providing these ❤️!

Note: You need to be 18 or older to claim the rewards!

We will announce winners here on Friday 5/16.
Good luck!

[PvJBlueTeam @PvJBlueTeam]

It's time! @BSidesNYC 2024 is happening, and so is Pros V Joes! We are going to be onsite, it's going to be awesome, and we want YOU to sign up as a Joe or Pro! Apply here! Apply Now!
Pro reg: https://t.co/QhcBrb1F9z
Joe reg: https://t.co/hESFYsbWbC

https://t.co/4zhFVfWOpQ

[PvJRedCell @PvJRedCell]

T minus ninteen hours until @PVJCTF at @BSidesLV! New this year, Red Cell offering valet parking!*

*vehicles not guaranteed

[SirAppSec @SirAppSec]

We should call Lua -> LuaIndex1
Just like prefixing dangerouslySetInnerHTML

[SirAppSec @SirAppSec]

Got to take part in the Pros vs Joes CTF in #BSidesLV 2023 where I got to defend hack and code systems and applications during the conference.

This tool was made just before the competition as prep, it monitors sensitive live file changes

https://t.co/4M9h7fWi78

[SirAppSec @SirAppSec]

https://t.co/E5dzQ6CFnU

All defcon 31 parties this year!

[SirAppSec @SirAppSec]

@GelosSnake This post SLAPS

[SirAppSec @SirAppSec]

@jit_io #jitty #DevSecOps

[SirAppSec @SirAppSec]

@ask_aubry My password is a deserialization polyglot to RCE

[Joseph Cox @josephfcox]

New: we proved it could be done. I used an AI replica of my voice to break into my bank account. The AI tricked the bank into thinking it was talking to me. Could access my balances, transactions, etc. Shatters the idea that voice biometrics are foolproof https://t.co/YO6m8DIpqR

[SirAppSec @SirAppSec]

@meijin007 למה אתה צריך לכתוב הוכחה מתמטית כל פעם שאתה עושה חשבון פשוט?

[SirAppSec @SirAppSec]

@_JohnHammond Greatest mind at works here

[SirAppSec @SirAppSec]

This is why we need a rigorous threat modeling ethics. #threatmodel #applicationsecurity