Lukas Weichselbaum

Leading @Google's web security team. Opinions are my own.
Bluesky: @webappsec.dev

[Lukas Weichselbaum @we1x]

My @LocoMocoSec keynote slides on "Google's Recipe for Scaling (Web) Security" are online now: https://t.co/0CaClh0lX0

[Lukas Weichselbaum @we1x]

Thank you @AndrsMartnezAl4! It was truly a pleasure to get to know you all!

[andresmtz @AndrsMartnezAl4]

Wrap @GoogleVRP and init.g(mexico)! Huge thanks to Anna, @we1x and everyone at Google for giving us a glimpse into this world. Getting to listen the many experts at these fields was truly inspiring and motivating. #initg #cybersecurity

[Google VRP (Google Bug Hunters) @GoogleVRP]

¡Hola from init.g(mexico) we are LIVE!
Crazy excited to meet all the incredible students who joined init.g(mexico) today! Very much looking forward to seeing how these bright minds can shape the security industry of tomorrow!
Let the learning and hacking begin! init.g() { return SUCCESS; }
#initg #ESCAL8 #GoogleMexico 🇲🇽

[terjanq @terjanq]

We published a blogpost about SafeContentFrame - a library for rendering untrusted content inside an iframe. The library is a big party of what I've been up to in the few last years! Check out the blog and take a slice of my birthday cake 🎂!

https://t.co/9gGEqUuwIX

[@[email protected] @SecurityMB]

Google CTF is on! Here's a challenge that I created:

https://t.co/I3RAWWN9u2.

Good luck 😀

[@[email protected] @SecurityMB]

Here's my blog post about escaping `<>` in attributes and why it makes mXSS harder to exploit!

[Google VRP (Google Bug Hunters) @GoogleVRP]

🚨 Heads up for web devs! 🚨

The HTML spec just got an important update to protect against mutation XSS (mXSS). Find out how escaping < and > in attributes is making the web a safer place.

https://t.co/gMKmo0x4ad

[Lukas Weichselbaum @we1x]

@manicode The many layers of stickers could provide enough structural integrity for your laptop to survive long enough 😀

[Lukas Weichselbaum @we1x]

@blueminimal @mhackeroni @Nautilus_CTF Congrats and for sure the best team name 🎉

[Lukas Weichselbaum @we1x]

One of my teams at Google, 𝗔𝗜 𝗔𝗴𝗲𝗻𝘁 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆, is expanding in 𝗭𝘂𝗿𝗶𝗰𝗵 🇨🇭and 𝗡𝗲𝘄 𝗬𝗼𝗿𝗸 🇺🇸. We're looking for 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗘𝗻𝗴𝗶𝗻𝗲𝗲𝗿𝘀 with experience in attacking and securing AI/ML systems. DMs open.

[Lukas Weichselbaum @we1x]

Safari Tech Preview 215: Added support for Trusted Types 🎉

https://t.co/RCd7uq9nbZ

[Devansh (⚡, 🥷) @0xAsm0d3us]

@ryancbarnett @akamai_research This reminds me of this cool paper from Google I read years back. The best possible resource for understanding common pitfalls in CSP

https://t.co/ae7RX4ocWf

[Lukas Weichselbaum @we1x]

@ndevtk @WeizmanGal Yes, that's correct. Images and links are the exfil scenarios to worry here (no script execution in markdown)

[Google VRP (Google Bug Hunters) @GoogleVRP]

Developers, tired of DOM XSS in your web applications? 😩 We were too. See how we refactored our code to solve Trusted Types violations in Gmail & AppSheet. Your guide to a safer web is here!

https://t.co/jywuZicT2N

[Lukas Weichselbaum @we1x]

@TanmayLP7 @NahamSec Yes, not everything is built on high assurance frameworks (yet) and the bounty for XSS was increased.

https://t.co/e8lmOYyACq

[koto @kkotowicz]

XSS in Gmail is now $20k (or 50% more for exceptional quality report). Good thing we don't have XSSes anymore.... Or do we? :)

[Lukas Weichselbaum @we1x]

@dinodaizovi Thank you @dinodaizovi

[Dino A. Dai Zovi @dinodaizovi]

This is a great example of secure by design through a framework-centric approach to security. The key idea is to build high-level frameworks that abstract away and address as many security risks as possible to make security better by default and as easy as possible for apps.

[Lukas Weichselbaum @we1x]

Building secure web apps shouldn't be a burden. We've built a high-assurance web framework at Google that makes security easy for developers. Learn about our "Secure by Design" approach and how it works in our new blog post:
https://t.co/Iq19llnlEj

cc: @ddworken

[Royal Hansen @royalhansen]

"This blog post aims to provide a detailed blueprint for how Google has created and deployed a high-assurance web framework that almost completely eliminates exploitable web vulnerabilities."
https://t.co/7TsK8ZFRrO

[Lukas Weichselbaum @we1x]

Building secure web apps shouldn't be a burden. We've built a high-assurance web framework at Google that makes security easy for developers. Learn about our "Secure by Design" approach and how it works in our new blog post:
https://t.co/Iq19llnlEj

cc: @ddworken