Pi3cH

(Cyber) security Researcher. 6x Founder. Senior Lecturer.

[Pi3cH @pi3ch]

AppSec Village CTF is a Black Badge contest this year. That's a big deal. #ctf #defcon #conference

[SecDim @secdim]

Challenge submissions for the AppSec Village Wargame Contest at DEF CON 34 are now open.

Build challenges with the SecDim Play SDK and win prizes at DEF CON 34.

More details below.

#appsec #securecoding #defcon #ctf

[Pi3cH @pi3ch]

@zench4n @ImNotAV1rus @levelsio Survivorship bias warning: this works when the problem is interesting enough to attract an audience pre-launch. Most indie apps aren't. You might just be building in public to zero readers, which is demoralizing in a different way.

[Pi3cH @pi3ch]

@zench4n CVE-2026-48710 doesn't exist yet — future CVE IDs aren't assigned like that. Host header injection tooling is useful, but verify you have the right identifier before shipping detection claims.

[Pi3cH @pi3ch]

@zench4n Starlette's `trusted_hosts` middleware checks `Host` header but forwarded headers like `X-Forwarded-Host` can slip through if your proxy config doesn't strip them upstream. Fix is in the proxy layer, not the app.

[Pi3cH @pi3ch]

@NordLayer VPN perimeter security is 2010 thinking. Zero trust with identity-aware proxies makes more sense for distributed teams — a VPN just moves your attack surface, not eliminates it.

[Pi3cH @pi3ch]

@helpnetsecurity @Microsoft @msftsecurity Passkeys eliminate phishing but the real attack surface shifts to account recovery flows and device sync. Attacker just targets iCloud/Google backup instead of phishing creds.

[Pi3cH @pi3ch]

@helpnetsecurity @RedHat @wiz_io @github @orcasec @step_security Supply chain compromise via npm maintainer account hijack — TOTP isn't enough when phishing bypasses it. Verified provenance (Sigstore/npm attestations) would've caught the package swap before install.

[Pi3cH @pi3ch]

@helpnetsecurity @HikvisionHQ Physical zero trust is just mTLS and least-privilege access control rebranded for badge readers. The hard part isn't the edge decision — it's your enrollment and identity binding, which is still a TOFU mess in most deployments.

[Pi3cH @pi3ch]

@helpnetsecurity @sciencetokyo_en @WHU_1893 @flexera Dormant backdoors that activate post fine-tuning are the supply chain attack vector most MLOps teams aren't scanning for. SBOM equivalents for model weights don't exist yet at any useful granularity.

[Pi3cH @pi3ch]

@DanKornas Clever hack, but you're proxying auth through a browser session — cookie theft or XSS on that page game-overs your entire Gemini account. Treat that local endpoint as fully untrusted surface.

[Pi3cH @pi3ch]

https://t.co/6MNzVZrXlt

[Pi3cH @pi3ch]

AI can verify what your software does.
It cannot verify what your software must never do.
That's not a tooling gap. That's Gödel.
🔗 in replies

#aisecurity #vibecoding #appsec

[Pi3cH @pi3ch]

@helpnetsecurity @Microsoft "Smarter" exposure scores still won't help if your asset inventory is incomplete. EASM coverage gaps mean the highest-risk exposed services never enter the scoring model.

[Pi3cH @pi3ch]

@0Drayne Job titles are just HR fiction. What matters is the scope: are you doing black-box recon on prod, or reviewing PRs? Those are different skills. Search for "VDP" or "bug bounty program" if you want pure hunting.

[Pi3cH @pi3ch]

@AppScanHCL Prompt-driven DAST sounds useful until the LLM hallucinates auth bypass coverage that isn't there. Who validates the test quality?

[Pi3cH @pi3ch]

@DanKornas Scope enforcement is the hard part — most "authorized" wrappers just trust the config file. How does pentest-ai prevent target drift when chained tool calls expand the attack surface mid-session?

[Pi3cH @pi3ch]

@helpnetsecurity @DataGrail Regulatory sprawl without harmonization just creates compliance theater. Teams chase checkbox audits while actual data flows — especially shadow AI inference endpoints — stay unmapped.

[Pi3cH @pi3ch]

@0x4D31 What's the deception layer — fake credentials in env vars, DNS canaries, or something at the protocol level?

[Pi3cH @pi3ch]

@_Shyam_V_ @github Codespaces on mobile is underrated. Full dev environment, zero local setup, works on any screen. The constraint is real but the toolchain is solid.

[Pi3cH @pi3ch]

Outsourcing your software security to an AI vendor is a ponzi scheme. You're locked in, spending thousands, with no way to know if the problem is ever actually solved.
#aisecurity #appsec