Arshan Dabirsiaghi (@nahsrasec)

A Prompt Is Not a Security Function

How one finding illustrates the need for people, process, technology -- and whether we can automate the bigger picture

Exploit Verification

Today marks an exciting day for all of us here at Pixee, and maybe in appsec? Excuse me some founder panaché. The Problem: Proving Exploitability Is Hard One of the hardest, most detail-oriented, and time consuming things to do with SAST is to try to...

4 min readnahsra.hashnode.dev

2Jul 22, 2025

SAST is just crazy bad at XSS

XSS is one of the more serious things in appsec, and it's pretty prevalent. It’s also one of those things that is super hard to find accurately via static analysis. And, vendors don’t want to miss it — so, typically any data that gets to a response, ...

4 min readnahsra.hashnode.dev

1Jul 10, 2025

"LLMs Can't Reason"

The top post on HN right now (well, yesterday) is about speaking more directly in the age of LLM "fluff". I have nothing to say about the piece’s main points. But, a sentence caught my eye that never seems to receive any pushback: While it's true th...

3 min readnahsra.hashnode.dev

Mar 31, 2025

Model providers give good advice for a change

Maturity around tools, practices is getting better

3 min readnahsra.hashnode.dev

Dec 30, 2024

Arshan Dabirsiaghi

About

Available for

Arshan Dabirsiaghi's blogs

A Prompt Is Not a Security Function

Exploit Verification

SAST is just crazy bad at XSS

"LLMs Can't Reason"

Model providers give good advice for a change

Arshan Dabirsiaghi

About

Available for

Arshan Dabirsiaghi's blogs

A Prompt Is Not a Security Function

Exploit Verification

SAST is just crazy bad at XSS

"LLMs Can't Reason"

Model providers give good advice for a change

Arshan Dabirsiaghi

About

Available for

Arshan Dabirsiaghi's blogs

A Prompt Is Not a Security Function

Exploit Verification

SAST is just crazy bad at XSS

"LLMs Can't Reason"

Model providers give good advice for a change

Search Hashnode

Arshan Dabirsiaghi

About

Available for

Arshan Dabirsiaghi's blogs

A Prompt Is Not a Security Function

Exploit Verification

SAST is just crazy bad at XSS

"LLMs Can't Reason"

Model providers give good advice for a change