Anti-Scraping Part 2: Implementing Protections

The first post in an anti-scraping series lays out five core principles: require authentication, enforce rate limits, lock down account creation, cap data volume, and return generic error messages.

Indirect prompt injection hides malicious instructions in content LLMs later read—email footers, PDFs, web pages. Real Microsoft 365 Copilot attacks make defense in depth and AI monitoring essential.

Using HacktronAI's OpenAI Discourse hack disclosure, this article covers sandboxing, runtime protection, and AI-assisted defense to shrink the blast radius of RCE across interconnected apps.

NetSPI vibe-coded a web app with AI coding tools and tested it for vulnerabilities; the results were mixed, showing why AI-generated code still needs proactive security review.

A deep dive into JavaScript prototype pollution: how attackers control undeclared variables to turn weakly-typed checks into XSS on the client side or remote code execution on the server side.

NetSPI examines why TOTP codes no longer stop determined attackers, walking through a brute force scenario and recommending stronger 2FA alternatives to replace time-based one-time passwords.