CCopperSunDevinbrasscoders.hashnode.dev·2d ago · 7 min readWhat BrassCoders Catches in OWASP PyGoatFour months ago, BrassCoders published a gap list for OWASP PyGoat: four documented vulnerabilities it didn't yet catch. A SQL injection. An insecure deserialization. A command injection reachable thr00
CCopperSunDevinbrasscoders.hashnode.dev·Sep 4 · 9 min readWill Your AI Write A Regex That Hangs Your Server?A regex your AI wrote in half a second can put your server on the floor for 27 minutes. That's not hyperbole: it's what happened to Cloudflare in July 2019, and the mechanism behind it, catastrophic b00
CCopperSunDevinbrasscoders.hashnode.dev·Sep 4 · 9 min readIDOR and Access Control in AI APIs, by the NumbersOWASP's Top 10 2021 found broken access control in 94% of tested applications — the highest occurrence count of any category, at 318,487 logged instances. The API-specific version of the same bug, Bro00
CCopperSunDevinbrasscoders.hashnode.dev·Sep 4 · 9 min readThe CVE Record on Insecure Deserialization in AI Python CodePyYAML's yaml.load carried a CVE rated 9.8 out of 10. PyTorch's torch.load carried one rated 9.3, in 2025, inside a parameter that PyTorch's own documentation called the safe way to load a model. Inse00
CCopperSunDevinbrasscoders.hashnode.dev·Sep 4 · 8 min readAI Code License Risk From Training-Data MemorizationYour AI coding assistant did not write that function from scratch. It predicted the next token, and the token before that, from a model trained on a large slice of public code. Most of the time the re00