PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Master C and C++ with our new Testing Handbook chapter

blog.trailofbits.com | blog | #appsec | #memory-safety | #code-review | #developer-security | #c | #trail-of-bits | #testing-handbook | #security-checklist
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

We released a new Testing Handbook chapter providing a comprehensive security checklist for C and C++ code review, covering Linux, Windows, and seccomp environments.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Your AI agent fixed the bug, but what else did it change?
We’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents.
blog · blog.trailofbits.com
A “proof” of Fermat’s Last Theorem that fits the margin
Trail of Bits found a Lean ≤4.33.1 bug: String.Pos.Raw.extract returns a full string where its spec says empty — enough to 'prove' Fermat's Last Theorem. Not a soundness flaw; fixed in 4.34.0-rc1.
blog · blog.trailofbits.com
Escalating a Windows driver registry bug to a kernel write primitive
A walkthrough of two Testing Handbook C/C++ challenges: a Linux ping command injection via inet_aton quirks, and Windows driver registry type confusion escalating to a kernel write primitive.
blog · aikido.dev
Vibe Check: The vibe coder’s security checklist
Vibe coding with AI tools like Cursor, Lovable, and v0 makes shipping fast, but generated code can leak API keys and invite SQL injection. This checklist covers essential safeguards before you deploy.
blog · borghq.io
Security Review for AI-Generated Code: What Changes Before Merge
More of every pull request is machine-drafted and the bug classes have not changed. What security review must catch in the diff before merge, and what it cannot.
blog · bugbunny.ai
Secure Software Development Lifecycle: Building Security Into the Work
Building security into normal delivery: the SSDLC guide argues security decisions must land at design review, feature kickoff, PR and release time—not as a late gate once architecture is locked.
Back