Anil Yuksel

Founder @ApyGuard

[Anil Yuksel @anilyukk]

Attackers rarely break in. They log in.

No rate limit on /login → credential stuffing.
JWT signature never checked → “role”:”admin”.

OWASP API2: Broken Authentication, in 90 seconds 👇

[Anil Yuksel @anilyukk]

UUIDs stop guessing, not leaking. Attackers find valid IDs in responses, shared links and logs, no brute force needed.

[Tib3rius @0xTib3rius]

Repeat after me: UUIDs are not a fix for IDOR.

[Anil Yuksel @anilyukk]

@EmadKhair95 Good point. Traffic alone can’t reliably tell required from optional, so we treat it as a heuristic, not a rule. You can review and adjust fields in the ApyGuard platform. For ground truth, APIScout reads the validation logic straight from source code.

[Anil Yuksel @anilyukk]

Most pentests I've run started the same way. No repo, no spec. A URL and a test account. Day one goes to mapping the API by hand.
ApyGuard API Discovery does that while you browse. Every call recorded, deduplicated, exported as OpenAPI. It all stays in your browser.

[Anil Yuksel @anilyukk]

Free for Chrome. It only sees what the UI calls, so it complements reading the code. It doesn't replace it.
https://t.co/LEpy0ZcqFC

[Andrej Karpathy @karpathy]

We'll be spending a lot more time trying to understand the outputs of language models. A few thoughts, tips & tricks:

Writing. Something I've had success with: Ask your LLM to explain something in ASD-STE100, it's a controlled language specification originally developed for aerospace maintenance documentation. LLMs well-versed in this language and it comes with heavy constraints on clean writing style that I often find a lot more readable. Sometimes I've tried to soften it a bit e.g. ask for "80% of the way to ASD-STE100" because the spec is quite stringent. But even better:

Diagrams / images. Instead of writing, ask your LLM to create a diagram. These can be a lot easier to process, parse, and understand. But even better:

Web pages. Ask for output "in HTML" to get a beautiful, interactive webpage. LLMs are getting really good at frontend and can create beautiful experiences, animations, etc. But even better:

Explainer videos. The output format I am most bullish on is fully custom / bespoke explainer videos generated on any arbitrary topic. Experiment with things like "Create a 3b1b style video explainer on X. Use my ElevenLabs API key for audio narration". (you'd need an API key for the latter or you can ask your LLM to find you decent free alternatives that use your local compute). This is actually starting to work!

In summary:
- As LLMs get better, they will do more and more of the legwork autonomously, and a lot more of our work will rise up the abstractions into oversight and understanding.
- Luckily, LLMs can help here too because as intelligence and code are increasingly abundant, you can ask for large, custom, discardable software artifacts (e.g. web apps, video explainers) that would have never made sense to create before. Push the boundaries here and you'll be surprised.

[Anil Yuksel @anilyukk]

FastAPI, Express, Django, Flask, NestJS. Reads what the code declares, doesn't test the running app.
https://t.co/Rh7AiRxkPi

[Anil Yuksel @anilyukk]

Your AI wrote a dozen endpoints this week. Which ones have no auth?
APIScout scans your backend locally and lists every route, method and handler with file:line. Flags the ones with no security declared. Diffs after every prompt.
Free. VS Code, Cursor, Windsurf.
#vibecoding

[Anil Yuksel @anilyukk]

The result?

You think you’ve tested the endpoint.

In reality, you’ve only tested its input validation.

[Anil Yuksel @anilyukk]

Finding an API parameter is not enough.

You also need to know what a valid value looks like.

Send the wrong value and the request may fail before it reaches the interesting business logic.

[Fatih Arslan @fatih]

My blog post about how I manage agents is finally ready. It first explains my bespoke `plans` setup, and then explains how @cursor_ai new Projects feature enabled me |o do so much more. It was the missing piece for me. Check it out:

https://t.co/TbIdJqxVGo

[Anil Yuksel @anilyukk]

I’ve seen APIs return exactly the same response for valid and invalid paths.

At that point, discovery becomes a very different problem.

[Anil Yuksel @anilyukk]

API pentesting without documentation can feel like searching for a needle in a haystack.

You need to discover endpoints, parameters and expected values before you can even start testing.

And brute force doesn’t always help.

[Anil Yuksel @anilyukk]

Which ID came from where? Which value should be reused next? Which fields are related?

Sometimes testing the vulnerability is easier than understanding the data flow.

[Anil Yuksel @anilyukk]

One underrated difficulty of API pentesting: there is no UI.

When a request has a huge JSON body and the response returns hundreds of fields, simply understanding what changed becomes a task itself.

[Anil Yuksel @anilyukk]

@canaksoy Burada aslinda hangi saldiridan korumak istiyorsunuz ona gore degerlendirmek lazim

[Anil Yuksel @anilyukk]

Modern APIs use OAuth2 and OIDC.

API security scanners should too.

ApyGuard Scanner now supports:
- OAuth2 Client Credentials
- OAuth2 Password Grant
- OIDC authentication flows

Because authorization bugs live behind authenticated APIs.

https://t.co/CDTxGWmdgd

#APISecurity

[Anil Yuksel @anilyukk]

Attackers adapt to API responses.
Scanners should too.

How are you handling OpenAPI spec drift?

[Anil Yuksel @anilyukk]

Most API scanners trust OpenAPI specs blindly.
That’s a mistake.

While testing open-source APIs with @ApyGuard , we kept seeing:

→ Required fields marked optional
→ Enums documented as plain strings
→ Backend validation drifting from the spec

[Anil Yuksel @anilyukk]

Result? Scanners send invalid requests, hit 400s, and never reach the auth layer — where the real bugs are.

So we rebuilt the request engine to adapt like a human pentester:

→ Parse validation errors
→ Learn real constraints
→ Retry with corrected payloads