1.AI Application Security Testing: The Authorisation Boundaryblog | 2026-09-14 15:50 | borghq.io | Original ↗ | .md | #ai-security | #appsec | #llm
2.How to Test Business Logic Vulnerabilities in a SaaS Applicationblog | 2026-08-11 10:10 | borghq.io | Original ↗ | .md | #authorization | #business-logic | #api-testing
3.Legal Boundaries of AI Penetration Testing: Engagements, Laws & Permissionsblog | 2026-08-04 12:00 | xbow.com | Original ↗ | .md | #ai-security | #pentesting | #agentic-ai
4.API Security Best Practices for Production APIsblog | 2026-06-20 07:00 | bugbunny.ai | Original ↗ | .md | #appsec | #devsecops | #api-security
5.Best Practices for API Security That Reduce Real Abuseblog | 2026-06-17 07:00 | bugbunny.ai | Original ↗ | .md | #appsec | #api-security | #best-practices
6.Web Application Security: The Controls That Still Matter Mostblog | 2026-06-06 07:00 | bugbunny.ai | Original ↗ | .md | #appsec | #web-security | #application-security
7.Security Testing for API: A Practical Workflow for Modern Teamsblog | 2026-06-01 07:00 | bugbunny.ai | Original ↗ | .md | #pentesting | #appsec | #api-security
8.Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sightblog | 2026-05-31 07:00 | bugbunny.ai | Original ↗ | .md | #appsec | #vulnerability-research | #access-control
9.Secure Code Review: How to Find Boundary Failures Before Releaseblog | 2026-05-30 07:00 | bugbunny.ai | Original ↗ | .md | #appsec | #devsecops | #code-review
10.Getting to “Should I?”, Instead of “Can I?”: How XBOW Finds IDORs With High Accuracy in Ambiguous Contextsblog | 2026-05-28 12:00 | xbow.com | Original ↗ | .md | #ai-security | #agentic-ai | #appsec
11.Tales From the Trace: How XBOW Reasons Its Way Into Finding IDORsblog | 2026-02-04 13:00 | CVE-2026-22588 | xbow.com | Original ↗ | .md | #agentic-ai | #appsec | #vulnerability-research
12.Agentic AI: the Confused Deputy problemresearch | 2026-01-27 23:00 | blog.quarkslab.com | Original ↗ | .md | #ai-security | #agentic-ai | #prompt-injection
13.How An Authorization Flaw Reveals A Common Security Blind Spot: CVE-2025-59305 Case Studyvulnerability | High | 2025-09-30 00:00 | CVE-2025-59305 | depthfirst.com | Original ↗ | .md | #ai-security | #vulnerability-research | #access-control
14.Detecting Authorization Flaws in Java Spring via Source Code Review (SCR)blog | 2025-07-09 00:00 | netspi.com | Original ↗ | .md | #appsec | #access-control | #java
15.Web & REST API Security Explainedadvisory | 2025-04-15 00:00 | aikido.dev | Original ↗ | .md | #rest-api | #api-security | #authentication
16.A Not So Comprehensive Guide to Securing Your Salesforce Organizationblog | 2025-03-31 00:00 | netspi.com | Original ↗ | .md | #appsec | #data-exposure | #rest-api
17.How an Improper Access Control Vulnerability Led to Account Theft in One Clickvulnerability | 2024-11-06 17:21 | hackerone.com | Original ↗ | .md | #bug-bounty | #access-control | #account-takeover
18.how to make a website hard to hackblog | 2022-08-03 00:00 | josephthacker.com | Original ↗ | .md | #bug-bounty | #web-security | #architecture
19.The Most Overlooked Server Permission Checksblog | 2022-06-23 16:00 | hackerone.com | Original ↗ | .md | #access-control | #code-review | #api-security
20.What Vuln Scanners Miss in API Testingtool | 2020-10-14 00:00 | bugcrowd.com | Original ↗ | .md | #access-control | #api-security | #vulnerability-scanning
21.Design Considerations for Secure GraphQL APIsblog | 2020-09-28 00:00 | bishopfox.com | Original ↗ | .md | #appsec | #api-security | #graphql
22.InterSystems Cache 2017.2.2.865.0 and 2018.1.2 Multiple Vulnerabilitiesadvisory | 2019-07-24 00:00 | CVE-2018-17150 | bishopfox.com | Original ↗ | .md | #xss | #xxe | #authorization
23.Take Him Away, Boys – Creating a Get-Out-of-Jail Letterblog | 2018-02-27 00:00 | netspi.com | Original ↗ | .md | #red-team | #social-engineering | #authorization
24.How-To: Find IDOR (Insecure Direct Object Reference) Vulnerabilities for Large Bounty Rewardsblog | 2017-11-09 00:00 | bugcrowd.com | Original ↗ | .md | #bug-bounty | #burp-suite | #web-security
25.The $30,000 Gem: Part 1blog | 2017-06-08 14:00 | hackerone.com | Original ↗ | .md | #access-control | #api-security | #graphql
26.Burp v1.4 preview - Testing access controls using your browserblog | 2011-03-22 09:45 | portswigger.net | Original ↗ | .md | #burp-suite | #access-control | #preview