--- title: "Arshan Dabirsiaghi (@nahsrasec) | Hashnode" description: "security nerd. Read the latest articles by Arshan Dabirsiaghi on Hashnode." url: "https://hashnode.com/@nahsrasec" --- @nahsrasec # Arshan Dabirsiaghi @nahsrasec · Joined November 2023 security nerd [Website](https://pixee.ai/) ### [A Prompt Is Not a Security Function](https://nahsra.hashnode.dev/a-prompt-is-not-a-security-function?utm_source=hashnode&utm_medium=feed) How one finding illustrates the need for people, process, technology -- and whether we can automate the bigger picture 6 min read · [nahsra.hashnode.dev](https://nahsra.hashnode.dev/a-prompt-is-not-a-security-function?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/a-prompt-is-not-a-security-function/6a4d0d8f85f47920f4ea38ce) [Jul 7](https://hashnode.com/posts/a-prompt-is-not-a-security-function/6a4d0d8f85f47920f4ea38ce) ### [Exploit Verification](https://nahsra.hashnode.dev/introducing-exploit-verification?utm_source=hashnode&utm_medium=feed) Today marks an exciting day for all of us here at Pixee, and maybe in appsec? Excuse me some founder panaché. The Problem: Proving Exploitability Is Hard One of the hardest, most detail-oriented, and time consuming things to do with SAST is to try to... 4 min read · [nahsra.hashnode.dev](https://nahsra.hashnode.dev/introducing-exploit-verification?utm_source=hashnode&utm_medium=feed) [2](https://hashnode.com/posts/introducing-exploit-verification/687fad9373f8850697c50c48) [Jul 22, 2025](https://hashnode.com/posts/introducing-exploit-verification/687fad9373f8850697c50c48) ### [SAST is just crazy bad at XSS](https://nahsra.hashnode.dev/sast-is-just-crazy-bad-at-xss?utm_source=hashnode&utm_medium=feed) XSS is one of the more serious things in appsec, and it's pretty prevalent. It’s also one of those things that is super hard to find accurately via static analysis. And, vendors don’t want to miss it — so, typically any data that gets to a response, ... 4 min read · [nahsra.hashnode.dev](https://nahsra.hashnode.dev/sast-is-just-crazy-bad-at-xss?utm_source=hashnode&utm_medium=feed) [1](https://hashnode.com/posts/sast-is-just-crazy-bad-at-xss/686fda204baf225bb8198991) [Jul 10, 2025](https://hashnode.com/posts/sast-is-just-crazy-bad-at-xss/686fda204baf225bb8198991) ### ["LLMs Can't Reason"](https://nahsra.hashnode.dev/llms-cant-reason?utm_source=hashnode&utm_medium=feed) The top post on HN right now (well, yesterday) is about speaking more directly in the age of LLM "fluff". I have nothing to say about the piece’s main points. But, a sentence caught my eye that never seems to receive any pushback: While it's true th... 3 min read · [nahsra.hashnode.dev](https://nahsra.hashnode.dev/llms-cant-reason?utm_source=hashnode&utm_medium=feed) [Mar 31, 2025](https://hashnode.com/posts/llms-cant-reason/67eaac6bbe4a507fbd534211) ### [Model providers give good advice for a change](https://nahsra.hashnode.dev/model-providers-give-good-advice-for-a-change?utm_source=hashnode&utm_medium=feed) Maturity around tools, practices is getting better 3 min read · [nahsra.hashnode.dev](https://nahsra.hashnode.dev/model-providers-give-good-advice-for-a-change?utm_source=hashnode&utm_medium=feed) [Dec 30, 2024](https://hashnode.com/posts/model-providers-give-good-advice-for-a-change/6772acd5a5c39e470d6add6f)