The APPSECREW Blog
Practitioner-written deep dives on application security, AI threats, cloud attack surfaces, and offensive security techniques — written by the people who actually test these things.
Featured
A stored XSS vulnerability in AnythingLLM's Chartable Markdown renderer lets attacker-controlled chart captions execute arbitrary JavaScript in another user's browser — with a full proof-of-concept walkthrough.
How attackers exploit unverified iss claims in OIDC/JWT implementations to forge tokens, bypass signature verification, and gain unauthorized access — with real code examples and fixes.
A technical deep-dive into prompt injection attacks — how they work, why they're so hard to prevent, and what engineering teams building LLM applications need to do right now.
A practitioner's breakdown of the latest OWASP Top 10 updates — which new categories matter, what dropped, and how to prioritize your remediation roadmap.
All Articles