Blog

Research articles and blog posts from SecDim

Tl;dr: Authentication alone could only hide API security weaknesses. Three security controls are required to address the root cause of...

Suppose the following function checks if a user can access a resource. What can go wrong? function checkAccess(User user, Resource...

We all know secret keys, passwords, API keys, tokens, payment card data (pin, pan, track2 data, cvv) should never be...

These submission fail for a good reason. The security vulnerability has not been fixed! Let’s find out why. uint is...

Over 6 hours of practical AppSec & DevSecOps video workshops This is summary of our live recording from Jan to...

Kubernetes Pod is insecure by default and It runs as root. This security misconfiguration can lead to arbitrary code execution....

Running a container as a root is dangerous. But why? Let’s first understand what is the difference between running a...

dApp security is a whole new world where we should re-learn and change our perspective on security concepts. In this...

in 2016, Uber paid out $10,000 for a security bug that could result into RCE. In this live workshop, we...