Thomas J. Raef

Passionate about website security and bringing truly affordable, effective website security to everyone!

[Thomas J. Raef @WeWatch]

@KatieKeithBarn2 Did Claude say you could finish your day??? In any of the 5 conversations??? Hmm???

[Thomas J. Raef @WeWatch]

@theohandsh We've built a vibe code analyzer. It finds vulnerabilities, verifies them and produces remediation code to fix the vulns.

[Thomas J. Raef @WeWatch]

5/ Fix is real work: price from the server, verify with a signed webhook, reject duplicate events.
How much of your checkout trusts the browser?

[Thomas J. Raef @WeWatch]

1/ On Monday I said the real risk in AI-built apps is boring: shipping with no security gate. Here's the worst one I found this week.

[Thomas J. Raef @WeWatch]

4/ The catch: a code scanner doesn't flag this. The code is valid. It just trusts the wrong source. It took a reasoning pass to find it.

[Thomas J. Raef @WeWatch]

@KhalfanMohKM7 I totally agree. They're shipping code that syntactically correct, but the logic is flawed.

[Thomas J. Raef @WeWatch]

Everyone fears AI writing malware. The real risk is more boring: it ships an unauthenticated route to your production DB and calls it done. Looks finished. Runs fine. Wide open. What's the 1st thing you check in AI-generated code?

[Thomas J. Raef @WeWatch]

@hthieblot Building a service to scan vibe coded apps/sites for vulnerabilities. Too many people are using the tool that built their app to then scan it for vulnerabilities.

We have a 5 stage process that is very complex.

[Thomas J. Raef @WeWatch]

@Jason I'm in

[Thomas J. Raef @WeWatch]

@CiprianiRanieri Let's connect

[Thomas J. Raef @WeWatch]

Check out my latest article: AI Built It, AI Will Break It https://t.co/ni3dEAcWvO via @LinkedIn

[Thomas J. Raef @WeWatch]

Here's a recent website malware case we worked:

https://t.co/oBkOLCyybP

[Thomas J. Raef @WeWatch]

@1Umairshaikh Right now? Network. We need to get in front of the right people.

[Thomas J. Raef @WeWatch]

@brockpierson I am.

[Thomas J. Raef @WeWatch]

@hthieblot We've built a website access log system. We ingest the logs, analyze them, report the malicious IPs to the responsible org and track everything. We have also built our own LLM that positively identifies website malware. It's better, faster, stronger than those using signatures.

[Thomas J. Raef @WeWatch]

I kept hearing about how "everyone" is using Fail2ban and/or Imunify360 to block attacks on xmlrpc.php and wp-login.php on their WordPress sites.

Here's the truth.

https://t.co/3DJxhYA7qW

[Thomas J. Raef @WeWatch]

@SinaHartung Everyone is dual roled. I love the post, but I see too many "creators" do nothing more than copy someone else's idea. They are consumers.

[Thomas J. Raef @WeWatch]

@VittoStack AI