The APIsec security testing platform discovers the most serious API vulnerabilities that lead to data theft and compromise.
San Francisco, CA 94103, USA
Joined April 2020
- Tweets178
- Following25
- Followers3.2K
- Likes47
Your coding agent rediscovers your API from scratch every session.
Which endpoint goes first. Which field is really required. Which call returns 200 and does nothing.
Sterling Chin on where that knowledge should live. apisec|con, Oct 21.
Code review used to ask "why did you write this?"
Now the author is an agent whose session already ended.
Sterling Chin on reviewing agent-written API code when nobody remembers why. Free, virtual, Oct 21.
Most AppSec programs aren't short on scanners.
They're short on capacity, context, and evidence.
Perry Menezes (ex-KPMG, Deutsche Bank) on running AI as a governed AppSec program, not another tool. apisec|con, Oct 21.
You can't recall an open-weight model.
No vendor safeguards. No usage monitoring. Capability months behind the frontier.
What has to change for defenders this year? Bashar Abouseido (ex-Schwab CISO) on it at apisec|con, Oct 21.
"Critical" findings that don't matter. Board reports that answer the wrong question.
Prioritize by exploitability, not severity.
Perry Menezes, apisec|con, Oct 21.
25 minutes. No demo. No code.
You leave with a 90-day plan, an agent risk register, and five metrics to take to your CISO.
Perry Menezes: How to Build an AppSec Program with Claude. apisec|con, Oct 21.
Your triage workflow assumes breathing space.
AI-assisted research is shrinking the gap between "vulnerable" and "exploitable."
A bug can become exploitable before your org decides whether it matters.
@HackWitHerr breaks it down 👇
#AppSec #AISecurity
Wrong company, same request.
Tenant isolation BOLA: rarer, highest blast radius. Even HackerOne's own platform had one.
Two users in one org won't find it. You need two orgs.
@HackWitHerr research:labs.apisec.ai/research/bola…
#BOLA #OWASP #SaaS
Questions we're bringing to Bashar Abouseido next Wednesday:
→ Should you plan as if every attacker has Mythos-level capability?
→ Should your source code go to frontier models at all?
→ What happens to AppSec jobs?
What's your question? apisec|con, Oct 21:
