Blog

Field notes.
Standards, not opinions.

What we find, how it works, and how to fix it — written the way our reports read. Every claim traces to a recognized standard.

AI SecurityJuly 18, 20264 min read

The OWASP LLM Top 10, Translated for Founders Shipping AI

Prompt injection, data disclosure, excessive agency — the three LLM risks that actually hurt, what reduces them, and why testing your chatbot isn't enough.

AppSecJuly 14, 20265 min read

JWT Algorithm Confusion: How the Wrong `alg` Forges Any User

Algorithm confusion lets an attacker sign valid JWTs with your public key. Why scanners miss it, how it works, and how to pin the algorithm and prove the fix.

More field notes in the pipeline · TheZyberSecurity

Field notes.Standards, not opinions.

The OWASP LLM Top 10, Translated for Founders Shipping AI

JWT Algorithm Confusion: How the Wrong `alg` Forges Any User

Field notes.
Standards, not opinions.