Longer-form work on how vulnerabilities are found, why classes of them recur, and what the tooling still misses.
When a developer runs npx skills add, the installer copies the entire skill directory into the repo. If a malicious skill includes a *.test.ts file, it runs during npm test and silently give an attacker full access to the developer’s machine.
Jeevan “JJ” Jutla
Broken access control has been the #1 vulnerability class since 2021. This post explores why it’s unsolved, why it will get worse, and how LLMs can bridge the gap.
Jeevan “JJ” Jutla
The gap between tracking where data flows and reasoning about whether the logic is correct.
Jeevan “JJ” Jutla
Gecko’s AI security engineer discovered critical chained vulnerabilities in Cal.com Cloud that allowed complete account takeover and exposed all booking data.
Jeevan “JJ” Jutla
Previously, there were entire classes of business logic and multi-step vulnerabilities that have long been invisible to SAST. Today, that changes.
Jeevan “JJ” Jutla