The landing page being free-tier Framer is a little sketch, the main contact should also probably be a form or an email address instead of a non-US phone number.

Is AI used throughout the entire process or just mainly focused on providing remedation recommendations based on the output of other tooling (scanners, JS analysis, secret scanning, etc.)?

Interesting project! Looking forward to see how it works and evolves.

It's easier to just become familiar with a DB UI tool like Beekeeper or DataGrip and spin up your own things. I'm also not a huge fan of being "locked-in" to so many things (including their auth). I think most projects would be better off keeping these parts separated, even if they are using third-party services to handle them, as it would be way less overhead to migrate out.

I had already left Notion as the app kept getting slower / bogged down and they added tons of useless clutter, and refused to support any form of E2E/local encryption.

Comments URL: https://news.ycombinator.com/item?id=43696899

Points: 8

# Comments: 0

Since this is a technique / overarching issue, it leans more towards being a CWE. Maybe something like:

- CWE-506: Embedded Malicious Code or - CWE-829: Inclusion of Functionality from Untrusted Control Sphere or - CWE-1395: Dependency on Vulnerable Third-Party Component

From Snyk's docs they also explain it: https://github.com/snyk/user-docs/blob/main/docs/manage-risk...

"In almost all cases, malicious packages are not assigned a CVE ID."

1) application security engineering 2) application penetration testing 3) devsecops 4) vulnerability management

It really is a big difference from each person on how they "break into" it. You've got great foundational qualifications, and probably just need to layer on extra "security" ones, if you don't already have them. If you're looking to start a company / start freelancing -- I've got no clue about that though.

If you're just dipping your toes further into the web app security side, OWASP has great labs, resources, etc. They have the WSTG (more for pentesters) and ASVS (more for devs), and of course their cheat sheets as well.

PortSwigger has great resources to read through on vulnerabilities and labs that will cover a ton of different vulnerabilities. HackTheBox also offers certification pathways: CBBH and CWEE, CBBH is more beginner/intermediate and involves a blackbox approach, where CWEE is more whitebox (from what it looks like).

Just because systems have gaps, doesn't mean the orgs actually want help with those gaps, esp. unsolicited. You could always take a look at bug bounty as well (through HackerOne or BugCrowd), but it can be pretty brutal for a beginner as it can involve a ton of recon or "going deep" to reach untouched areas of an app.

Comments URL: https://news.ycombinator.com/item?id=43563488

Points: 3

# Comments: 0

A lot of scanning templates / rulesets won't be 100% accurate or up-to-date, and will easily miss a lot of big things, so having it pentested by an actual person is always important.

From the source code side of things, Semgrep / CodeQL, Veracode / Snyk, Burp Enterprise (CI/CD), etc. are good options. But again, most places shouldn't get just scans, there should be a manual component involving a security professional who knows what they're doing.

XBOW is making some pretty cool strides in the meantime from a blackbox perspective though.

I use GitHub Pages for hosting, Porkbun for the domain, and Astro for the blog itself. EZPZ to manage and very straightforward, plus Astro's docs are great.

Comments URL: https://news.ycombinator.com/item?id=43557652

Points: 1

# Comments: 0

The speed is an awesome gain though, as it's truly lightweight and runs a million times better than Burp. Even without Extensions, some days my Burp Pro is just randomly crashing and gobbling up CPU/RAM for no obvious reason and requires a program or system restart. I've never run into the same issue with Caido.

When it comes to random companies running their own VDP vs. hiring it out, it can be less than standard despite there being lots of resources on setting it up. I've seen ones that only include a phone number, the email address listed doesn't exist anymore, etc.

Others have had to even get to the point of contacting an executive via LinkedIn despite there being a VDP page / security.txt.

Comments URL: https://news.ycombinator.com/item?id=43492566

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=43482854

Points: 1

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=43449182

Points: 3

# Comments: 0

I generally say that anything under 500ms is good for commands that aren't crunching data, and even Python CLI tools can come in under that number without too much effort.