@nahsrasec

Arshan Dabirsiaghi

@nahsrasecJoined November 2023

security nerd

Website

About

CTO @ Pixee. ai (@pixeebot on GitHub)

ex Chief Scientist @ Contrast Security

Security researcher pretending to be a software executive.

Available for

Nothing here yet.

Arshan Dabirsiaghi's blogs

security in softwarenahsra.hashnode.dev13 posts

A Prompt Is Not a Security Function

What does it mean for a finding to be a “False Positive” to your team? I watch a lot of metrics on the SAST+SCA triage harness we build at Pixee. Among them are jitter (how often the system changes it

1Jul 7 · 6 min readnahsra.hashnode.dev

Exploit Verification

Today marks an exciting day for all of us here at Pixee, and maybe in appsec? Excuse me some founder panaché. The Problem: Proving Exploitability Is Hard One of the hardest, most detail-oriented, and time consuming things to do with SAST is to try to...

2Jul 22, 2025 · 4 min readnahsra.hashnode.dev

SAST is just crazy bad at XSS

XSS is one of the more serious things in appsec, and it's pretty prevalent. It’s also one of those things that is super hard to find accurately via static analysis. And, vendors don’t want to miss it — so, typically any data that gets to a response, ...

1Jul 10, 2025 · 4 min readnahsra.hashnode.dev

"LLMs Can't Reason"

The top post on HN right now (well, yesterday) is about speaking more directly in the age of LLM "fluff". I have nothing to say about the piece’s main points. But, a sentence caught my eye that never seems to receive any pushback: While it's true th...

Mar 31, 2025 · 3 min readnahsra.hashnode.dev

Model providers give good advice for a change

This is a great piece by Anthropic. Usually the model providers push you towards complex, high maintenance, and ultimately flakey solutions. This resonates. It seems we all now agree that LLMs are primarily good at data extraction, data summarization...

Dec 30, 2024 · 3 min readnahsra.hashnode.dev

Arshan Dabirsiaghi

About

Available for

Arshan Dabirsiaghi's blogs

A Prompt Is Not a Security Function

Exploit Verification

SAST is just crazy bad at XSS

"LLMs Can't Reason"

Model providers give good advice for a change

Search Hashnode

Arshan Dabirsiaghi

About

Available for

Arshan Dabirsiaghi's blogs

A Prompt Is Not a Security Function

Exploit Verification

SAST is just crazy bad at XSS

"LLMs Can't Reason"

Model providers give good advice for a change