Refactor Security

We help teams build safer software through practical, engineering-driven security.

[Refactor Security @refactorsec]

We just made it to @BSidesTampa Unlucky13, and it’s already been great to be here 🌴🏴‍☠️

Even before getting to the venue at @USouthFlorida, you could tell the team put a lot of care into the details; clear parking directions, check-in info, and everything you need to get settled.

The energy is awesome. Around 2,000 people are here, plus what looks like a huge group of volunteers helping keep things moving.

There are also several villages and tracks running in parallel, covering everything from offense and defense to CISO topics, IoT hacking, AI, and more. Plenty to learn, plenty of people to meet, and a really strong community vibe.

Looking forward to catching up with friends and meeting new folks 🤝

If you’re here and want to connect, shoot us a message.

Enjoy the conference!

[Refactor Security @refactorsec]

The most common LLM security problems usually don’t start with advanced attacks.

They come from production systems that still have prototype assumptions: the model is trusted too much, the tools are scoped too loosely, and the guardrails live in prompts instead of code.

We put together a short post on 5 vulnerabilities that show up repeatedly in LLM deployments:

https://t.co/fEttNGJy0y

[Refactor Security @refactorsec]

🚀 @HackSpaceCon 2026 mission accomplished!

We had a great time attending Hack Space Con this year. It was especially interesting to see so many conversations centered around the intersection of cybersecurity and space, along with the latest developments in AI.

With the recent Artemis II launch still fresh in everyone’s mind, the space and cybersecurity themes felt especially relevant.

We also really enjoyed connecting with security practitioners, researchers, engineers, and newcomers who are just as excited about this space/cyber crossover as we are. 🧑‍🚀

And as Space Coast locals, the conference gave us the perfect excuse to revisit the @ExploreSpaceKSC!

Big thanks to the organizers, speakers, sponsors, volunteers and everyone we met along the way.

Already looking forward to the next mission, and to @BSidesTampa next Saturday! 🏴‍☠️

[Refactor Security @refactorsec]

We wrote a blog post about why it's a bad idea to use domains like https://t.co/8XT6Bvu4Ax and https://t.co/9ViFeudvD4 during testing and in security write-ups.

Even though it’s very common to use them in PoC examples and payloads, they may end up being executed by people validating findings, potentially leaking information to uncontrolled third parties.

To make things worse, these patterns have made their way into LLM training data, and agents are more than happy to reuse them during testing.

Read the full blog post:
https://t.co/KEbeSInILx

#pentesting #aiagents #appsec

[Refactor Security @refactorsec]

AI agents are evolving, but manual pentesting isn’t going away anytime soon.

To cut out the repetitive friction in @Burp_Suite, we built 3 lightweight extensions to sharpen your workflow:

Tab Autonamer: Dynamic naming for Repeater/Intruder tabs.

Find in History: Instant jumps from Search to Proxy entries.

Forward OPTIONS: Auto-skip preflight noise.

Low on flash, high on efficiency. 🛠️

Get them on GitHub:👉 https://t.co/ZpZ5nb0OE4
Full breakdown:👉 https://t.co/UbCV5vtCaK

#BugBountyTips #Pentesting #BurpSuite #AppSec #RedTeaming

[Refactor Security @refactorsec]

We’ve just launched our new website: https://t.co/I152J6fMaN

Built to better reflect how we approach security: no checklists, no noise—just real-world testing and meaningful results.

[Refactor Security @refactorsec]

Have you ever needed to share a log file, JSON, or configuration file with a colleague, a vendor, or an AI assistant—but hesitated because of the sensitive data inside? 🛑

You need to keep the data structure intact for debugging, but you can't risk exposing PII, API keys, or credentials.

Today, we are releasing https://t.co/6PP9gDCUQb 🚀

It’s an open-source tool designed to sanitize your data before you share it anywhere. It supports formats like HTTP, JSON, XML, and YAML, replacing sensitive information with realistic placeholders.

Most importantly? It runs 100% in your browser. There is no backend processing, so your sensitive data never leaves your device.

Give it a try: https://t.co/JiG9EpPfOv
Check out the repo: https://t.co/uR2fqjKYvF

#infosec #privacy #devtools #opensource

[Refactor Security @refactorsec]

Excited to announce a new release of Security Notes, our tool designed for performing and documenting security source code reviews ✍

This version includes numerous improvements, bug fixes, and a major new feature: Breadcrumbs 🍞

We designed Breadcrumbs to solve a common challenge: getting lost in the "rabbit hole" of a complex review. This feature allows you to track the implementation of a single function or feature across multiple source files, leaving "crumbs" in code snippets to map your path 🐇

We'd love for you to give it a try 🤝

Your feedback is always welcome! 💡

Visual Studio Code Marketplace: https://t.co/CHHYuSLE1J
Github project: https://t.co/WO6AcppZR8

#appsec #bugbountytips #vscode #devsecops

[Refactor Security @refactorsec]

What a week for cybersecurity in the Sunshine State!

We are at @BsidesORL at @FullSail, and the event is just getting started with an awesome crowd.

Looking forward to some great talks and meeting new people. Reach out if you want to connect today or at the upcoming events!

Next stops: @bsidessoflo and @BSidesStPete.

#BSides #InfoSec #Cybersecurity

[Refactor Security @refactorsec]

Be extra careful when using the @defcon open Wi-Fi and submitting credentials over insecure protocols ⚠️

You don't want to get roasted by the Packet Hacking Village on the @wallofsheep 🐑

#defcon33

[Refactor Security @refactorsec]

Always a pleasure visiting @defcon’s @appsec_village!

Just enjoyed Laurence Tennant’s insightful talk on commonly overlooked cross-site WebSocket hijacking (CSWSH).

#DEFCON33 #AppSec

[Refactor Security @refactorsec]

Amazing talk by @albinowax on why 'HTTP/1.1 must die', unveiling new desync attacks and sharing how his research earned over $350K in bug bounties!

#defcon33 #AppSec #BugBounty

[Refactor Security @refactorsec]

It wouldn't be @defcon without a sea of stickers! We've hidden ours somewhere in these photos. Think you can spot it? 👀

#defcon33 #StickerLife

[Refactor Security @refactorsec]

The @MaritimeVillage is absolutely crushing their debut at #defcon33! They didn't just show up, they brought unmanned vehicles and a full-on Coast Guard rescue boat. What an incredible setup!

[Refactor Security @refactorsec]

In case you are into defense, make sure to visit the @BlueTeamVillage at #DEFCON33! Cool setup and some killer CTFs you don’t want to miss. 🛡️

#BlueTeam

[Refactor Security @refactorsec]

Love hacking web apps? 🕵️‍♂️ Swing by the @BugBountyDEFCON village!

Just caught an awesome talk by @Rhynorater, sharing pro tips for hacking with @CaidoIO. Don’t miss out!

#defcon33 #BugBounty

[Refactor Security @refactorsec]

@defcon 33 is here! We are excited to reconnect with friends and meet new faces.

Rumor has it: view the billboard through this year's badge color lenses to kick off the challenge! #DEFCON33

[Refactor Security @refactorsec]

Refactor Security turns 3 today! 🎉

Three years ago, we started Refactor Security with the goal of making security more practical and effective for modern teams. It's been an incredible journey so far, and we’re proud of the progress we’ve made together.

None of that happens without our incredible team, our trusted partners, and the friends who supported us from day one. We are grateful for everything we've accomplished together. Thank you 🙌

As we step into year four, we’re more energized than ever to keep working hard and to help even more companies build and ship securely.

Let’s keep pushing security forward! 🚀

[Refactor Security @refactorsec]

Another year, another @defcon

DEF CON 32 is under way on a new venue: Las Vegas Convention Center!

#defcon #defcon32