XSS is one of the more serious things in appsec, and it's pretty prevalent. It’s also one of those things that is super hard to find accurately via static analysis. And, vendors don’t want to miss it — so, typically any data that gets to a response, ...
security nerd
CTO @ Pixee. ai (@pixeebot on GitHub) ex Chief Scientist @ Contrast Security Security researcher pretending to be a software executive.
Markdown supported · ⌘↵ to post
Ryan Dens
It's crazy to me how much noise appsec/prod sec engineers have to sift through to get actionable, validated insights on their code.
"Example 1 of 10 Million" really got me 🤣