We just made it to @BSidesTampa Unlucky13, and it’s already been great to be here 🌴🏴‍☠️ Even before getting to the venue at @USouthFlorida, you could tell the team put a lot of care into the details; clear parking directions, check-in info, and everything you need to get settled. The energy is awesome. Around 2,000 people are here, plus what looks like a huge group of volunteers helping keep things moving. There are also several villages and tracks running in parallel, covering everything from offense and defense to CISO topics, IoT hacking, AI, and more. Plenty to learn, plenty of people to meet, and a really strong community vibe. Looking forward to catching up with friends and meeting new folks 🤝 If you’re here and want to connect, shoot us a message. Enjoy the conference!

The most common LLM security problems usually don’t start with advanced attacks. They come from production systems that still have prototype assumptions: the model is trusted too much, the tools are scoped too loosely, and the guardrails live in prompts instead of code. We put together a short post on 5 vulnerabilities that show up repeatedly in LLM deployments: blog.refactorsecurity.com/po…

🚀 @HackSpaceCon 2026 mission accomplished! We had a great time attending Hack Space Con this year. It was especially interesting to see so many conversations centered around the intersection of cybersecurity and space, along with the latest developments in AI. With the recent Artemis II launch still fresh in everyone’s mind, the space and cybersecurity themes felt especially relevant. We also really enjoyed connecting with security practitioners, researchers, engineers, and newcomers who are just as excited about this space/cyber crossover as we are. 🧑‍🚀 And as Space Coast locals, the conference gave us the perfect excuse to revisit the @ExploreSpaceKSC! Big thanks to the organizers, speakers, sponsors, volunteers and everyone we met along the way. Already looking forward to the next mission, and to @BSidesTampa next Saturday! 🏴‍☠️

We wrote a blog post about why it's a bad idea to use domains like evil.com and attacker.com during testing and in security write-ups. Even though it’s very common to use them in PoC examples and payloads, they may end up being executed by people validating findings, potentially leaking information to uncontrolled third parties. To make things worse, these patterns have made their way into LLM training data, and agents are more than happy to reuse them during testing. Read the full blog post: blog.refactorsecurity.com/po… #pentesting #aiagents #appsec

AI agents are evolving, but manual pentesting isn’t going away anytime soon. To cut out the repetitive friction in @Burp_Suite, we built 3 lightweight extensions to sharpen your workflow: Tab Autonamer: Dynamic naming for Repeater/Intruder tabs. Find in History: Instant jumps from Search to Proxy entries. Forward OPTIONS: Auto-skip preflight noise. Low on flash, high on efficiency. 🛠️ Get them on GitHub:👉 github.com/RefactorSecurity Full breakdown:👉 blog.refactorsecurity.com/po… #BugBountyTips #Pentesting #BurpSuite #AppSec #RedTeaming

We’ve just launched our new website: refactorsecurity.com/ Built to better reflect how we approach security: no checklists, no noise—just real-world testing and meaningful results.

Have you ever needed to share a log file, JSON, or configuration file with a colleague, a vendor, or an AI assistant—but hesitated because of the sensitive data inside? 🛑 You need to keep the data structure intact for debugging, but you can't risk exposing PII, API keys, or credentials. Today, we are releasing redactor.sh 🚀 It’s an open-source tool designed to sanitize your data before you share it anywhere. It supports formats like HTTP, JSON, XML, and YAML, replacing sensitive information with realistic placeholders. Most importantly? It runs 100% in your browser. There is no backend processing, so your sensitive data never leaves your device. Give it a try: redactor.sh Check out the repo: lnkd.in/d2HAC8Py #infosec #privacy #devtools #opensource

Excited to announce a new release of Security Notes, our tool designed for performing and documenting security source code reviews ✍ This version includes numerous improvements, bug fixes, and a major new feature: Breadcrumbs 🍞 We designed Breadcrumbs to solve a common challenge: getting lost in the "rabbit hole" of a complex review. This feature allows you to track the implementation of a single function or feature across multiple source files, leaving "crumbs" in code snippets to map your path 🐇 We'd love for you to give it a try 🤝 Your feedback is always welcome! 💡 Visual Studio Code Marketplace: marketplace.visualstudio.com… Github project: github.com/RefactorSecurity/… #appsec #bugbountytips #vscode #devsecops

What a week for cybersecurity in the Sunshine State! We are at @BsidesORL at @FullSail, and the event is just getting started with an awesome crowd. Looking forward to some great talks and meeting new people. Reach out if you want to connect today or at the upcoming events! Next stops: @bsidessoflo and @BSidesStPete. #BSides #InfoSec #Cybersecurity

Be extra careful when using the @defcon open Wi-Fi and submitting credentials over insecure protocols ⚠️ You don't want to get roasted by the Packet Hacking Village on the @wallofsheep 🐑 #defcon33

Always a pleasure visiting @defcon’s @appsec_village! Just enjoyed Laurence Tennant’s insightful talk on commonly overlooked cross-site WebSocket hijacking (CSWSH). #DEFCON33 #AppSec

Amazing talk by @albinowax on why 'HTTP/1.1 must die', unveiling new desync attacks and sharing how his research earned over $350K in bug bounties! #defcon33 #AppSec #BugBounty

It wouldn't be @defcon without a sea of stickers! We've hidden ours somewhere in these photos. Think you can spot it? 👀 #defcon33 #StickerLife

The @MaritimeVillage is absolutely crushing their debut at #defcon33! They didn't just show up, they brought unmanned vehicles and a full-on Coast Guard rescue boat. What an incredible setup!

In case you are into defense, make sure to visit the @BlueTeamVillage at #DEFCON33! Cool setup and some killer CTFs you don’t want to miss. 🛡️ #BlueTeam

Love hacking web apps? 🕵️‍♂️ Swing by the @BugBountyDEFCON village! Just caught an awesome talk by @Rhynorater, sharing pro tips for hacking with @CaidoIO. Don’t miss out! #defcon33 #BugBounty

Refactor Security turns 3 today! 🎉 Three years ago, we started Refactor Security with the goal of making security more practical and effective for modern teams. It's been an incredible journey so far, and we’re proud of the progress we’ve made together. None of that happens without our incredible team, our trusted partners, and the friends who supported us from day one. We are grateful for everything we've accomplished together. Thank you 🙌 As we step into year four, we’re more energized than ever to keep working hard and to help even more companies build and ship securely. Let’s keep pushing security forward! 🚀

Another year, another @defcon DEF CON 32 is under way on a new venue: Las Vegas Convention Center! #defcon #defcon32

We'll be at Vegas attending @defcon from Thursday through Sunday. Hit us up if you’re going — we’re always open to meeting new people and catching up with old friends! #defcon32 #defcon #cybersecurity #hackersummercamp