PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Code Reviewer Spotlight: Matt Buzanowski

hackerone.com | blog | #appsec | #code-review | #secure-coding | #interview | #hackerone | #pullrequest
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

PullRequest reviewer Matt Buzanowski explains how a decade in offensive security shapes his code reviews, surfacing logic flaws and edge cases that automated scans and black-box pentests miss.
Published
Collected

Related coverage

blog · borghq.io
Security Review for AI-Generated Code: What Changes Before Merge
More of every pull request is machine-drafted and the bug classes have not changed. What security review must catch in the diff before merge, and what it cannot.
blog · netspi.com
Performing Code Reviews to PCI Requirements
A NetSPI post maps PCI requirements to the OWASP Top 10 for code reviews, noting gaps like track-data retention rules that OWASP does not cover, since no single PCI code-review checklist exists.
blog · netspi.com
The Way Back Machine – Microsoft Word for Windows 1.1a
After Microsoft open-sourced Word for Windows 1.1a, a CheckMarx scan of the 1980s C++ codebase surfaced strcpy-style unsafe functions and 123 gotos—showing how far secure coding has come.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase
HackerOne ran Anthropic's Mythos 5 model against its own production code; it surfaced a critical RCE spanning three safe-in-isolation commits, illustrating compositional risk that diff review misses.
Back