Blog Posts

Six Years of Secure Code Warrior: Are we grown up yet?

International Women in Engineering Day: Meet Our Stars

The growth spurt: Happy 5th birthday, Secure Code Warrior

Women in Security: Spotlight on Fatemah Beydoun

Empathy, Gratitude, and Staying Humble: The Foundation of Our Culture

Secure Code Warrior and Bugcrowd: A Match Made in Security Geek Heaven

Happy 4th Birthday Secure Code Warrior, You Cheeky Little Toddler

Secure Code Warrior - Happy 3rd Birthday to us

If AppSec tooling is the silver bullet, why are so many companies not firing it?

Building trust: The path to true security synergy between AppSec and developers

Starting "left of left": Is secure code always quality code?

Build secure coding skills at every stage of the SSDLC

Want developers to code with security awareness? Bring the training to them.

Stop disrupting my workflow! How you can get the right security training at the right time

Webinar: Are you ready to put the "Sec" in DevOps?

Turning boring PCI-DSS compliance into a meaningful exercise for everybody: Part 2 - CISOs and developer awareness

Turning boring PCI-DSS compliance into a meaningful exercise for everybody: Part 1 - AppSec

DevSecOps in DACH: Key findings from secure coding pilot programs

How to Become a Kick-Ass DevSecOps Engineer

Why DevOps Implementation is Often Unsuccessful (and How You Can Fix It)

How creative CISOs and CIOs can innovate and transform their security program

DevSecOps: The Old Security Bugs Still Performing New Tricks

A Brighter Future For DevSecOps? It's Closer Than You Think

Are your developers the first line of risk or defense? Rate your company against our Secure Coding Checklist

Running IntelliJ Inspections From Continuous Integration

Java Gotchas - Bitwise vs Boolean Operators

How to catch and fix a Guice dependency injection issue using Sensei

Coders Conquer Security OWASP Top 10 API Series - Improper Assets Management

Amending Method and Class Visibility for JUnit 5

Automatically Adding a Private Constructor with Sensei

Improving A Personal Programming Process Using Sensei

Migrating to a Logger with Sensei

Coders Conquer Security OWASP Top 10 API Series - Insufficient Logging and Monitoring

Sharing Cookbooks within a Team

Coders Conquer Security OWASP Top 10 API Series - Disabled Security Features/Debug Features Enabled/Improper Permissions

Using Documentation Links with Sensei

Adding Parameters to Annotations Using Rewrite Actions

Coders Conquer Security OWASP Top 10 API Series - Mass Assignment

Coders Conquer Security OWASP Top 10 API Series - Missing Function Level Access Control

Coders Conquer Security OWASP Top 10 API Series - Lack of Resources and Rate Limiting

Coders Conquer Security OWASP Top 10 API Series - Excessive Data Exposure

Coders Conquer Security OWASP Top 10 API Series - Broken Authentication

Coders Conquer Security OWASP Top 10 API Series - Broken Object Level Authorization

Coders Conquer Security Infrastructure as Code Series - Business Logic

Coders Conquer Security Infrastructure as Code Series - Using Components From Untrusted Sources

Coders Conquer Security Infrastructure as Code Series: Security Misconfiguration - Improper Permissions

Coders Conquer Security Infrastructure as Code Series: Insufficient Transport Layer Protection

Coders Conquer Security Infrastructure as Code Series: Insecure Cryptography

Coders Conquer Security Infrastructure as Code Series: Plaintext Storage of Passwords

Coders Conquer Security Infrastructure as Code Series: Missing Function Level Access Control

Coders Conquer Security Infrastructure as Code Series: Disabled Security Features

Coders Conquer Security: Share & Learn Series - Insecure Deserialization

Coders Conquer Security: Share & Learn Series - Sensitive Data Exposure

Coders Conquer Security: Share & Learn Series - XXE Injection

Coders Conquer Security: Share & Learn Series - CRLF Injection

Coders Conquer Security: Share & Learn Series - Remote File Inclusion

Coders Conquer Security: Share & Learn Series - Local File Inclusion and Path Traversal

Coders Conquer Security: Share & Learn Series - Insufficient Transport Layer Protection

Coders Conquer Security: Share & Learn Series - XML Injections

Coders Conquer Security: Share & Learn Series - Insufficient Logging and Monitoring

Coders Conquer Security: Share & Learn Series - Unvalidated Redirects and Forwards

Coders Conquer Security: Share & Learn Series - Code Injection

Coders Conquer Security: Share & Learn Series - Broken Access Control

Coders Conquer Security: Share & Learn Series - Information Exposure

Coders Conquer Security: Share & Learn Series - Using Components with Known Vulnerabilities

Coders Conquer Security: Share & Learn Series - Authentication

Coders Conquer Security: Share & Learn Series - Insufficient Anti-Automation

Coders Conquer Security: Share & Learn Series - Business Logic Problems

Coders Conquer Security: Share & Learn Series - Email Header Injection

Coders Conquer Security: Share & Learn Series: Insecure Direct Object Reference

Coders Conquer Security: Share & Learn Series - Insecure Cryptographic Storage

Coders Conquer Security: Share & Learn Series - XQuery Injection

Coders Conquer Security: Share & Learn Series - Security Misconfigurations

Coders Conquer Security: Share & Learn Series - Clickjacking

Coders Conquer Security: Share & Learn Series - OS Command Injection

Coders Conquer Security: Share & Learn Series - Session Management Weaknesses

Coders Conquer Security: Share & Learn Series - Padding Oracle

Coders Conquer Security: Share & Learn Series - LDAP Injections

Coders Conquer Security: Share & Learn Series - Unrestricted File Uploads

Coders Conquer Security: Share & Learn Series - NoSQL Injection

Coders Conquer Security: Share & Learn Series - Cross-Site Request Forgery

Coders Conquer Security: Share & Learn - SQL Injection

Coders Conquer Security: Share & Learn - Cross-Site Scripting

How to roll out effective developer security training: 5 important lessons

Current secure code training is letting developers down

Why secure code training doesn’t stack up (and what you can do about it)

Developers have motivations to learn about secure coding…so why aren’t they?

What part does the human element play in the future of secure coding?

We need heroes to secure our code. Have developers got what it takes?

Shifting the focus from reactive to proactive, with human-led secure coding

For developers to help slay the cybercrime beast, training is a quest in two parts

What is static analysis?

2021 cybersecurity predictions: The intergalactic battle begins

My pentester, my enemy? Developers reveal what they really think about pentesting and static analysis results

The future of work is flexible, and it's great for cybersecurity

How the Australian Government can build national cybersecurity resilience and stand tall against threats

Rust is the most-loved programming language for the fifth time. Is it our new security savior?

From COBOL to Go: Why We Must Support Legacy Security Training and Beyond

The future of cybersecurity: What WON'T be happening in the year to come

The new NIST guidelines: Why customized training is essential to create secure software

Static Vs. Dynamic Cybersecurity Training: Impulsive Compliance, Future Problems

It takes a village: How community spirit creates more secure developers

In-depth security training is raising questions in education

Why we need to support, not punish, curious security minds

For Cybersecurity Best Practice, Look to the Finance Industry

The Change We Need In The AppSec Badlands: My 2019 Predictions

Confusing Privacy with Security: The Fatal Mistake

Why SQL Injections Are The Cockroaches of the AppSec World (and how CISOs can eradicate them once and for all)

Why gamification is the key to leveling up your software security

Some CISOs are turning the security skills shortage into an opportunity

"Explosive" cyber attacks in Oil and Gas are life threatening

One line of code, $1 million

Moving from academic research to industry is non-trivial

What security practices do 300,000 developers really do?

Shifting Left

Take a lesson from this mindreader and make security fun again!

The million dollar question every developer should be asking their prospective employers

Happy birthday SQL injection, the bug that can’t be squashed

Cybercriminals Are Attacking Healthcare (But We Can Fight Back)

Shifting left is not enough: Why starting left is your key to software security excellence

The Revamped PCI Security Standards Council Guidelines: Do They Shift Far Enough Left?

Developer Tournaments: AppSec's Secret Weapon to Improve Security Culture and Engagement

The forgotten human factor driving web application security flaws

Secure Coding Technique: Processing XML data, part 1

Secure coding technique: Default behavior of Zip libraries can lead to Remote Code Execution

A video game to improve the hiring process

Secure coding technique: The Custom Permission Problem

Secure coding technique: Avoiding username enumeration through side-channel attacks

Cybersecurity Training and Positive Reinforcement

Secure coding technique: Securely deleting files

ClickShare Vulnerabilities May Have Been Patched, But They Mask a Much Bigger Problem

Death by Doki: A new Docker vulnerability with serious bite (and what you can do about it)

Is your organization really DevSec-ready? Put it to the test.

The most dangerous software errors of 2019: More evidence of history repeating

The Great Global Patch: VxWorks Flaws Set to Compromise Millions of Devices

Huawei security UK problems demonstrate the need for secure coding

GitHub Users Held to Ransom with Plaintext Pain

Software Security is in the Wild West (and it's going to get us killed)

More Breaches, More Problems: The Cost of Trust in Third-Party Apps

Secure coding technique: Android device encryption and Direct Boot

Secure coding technique: Let's talk about Tapjacking

Copy/Paste is a dangerous coding technique

Hello from the other side. Interview with a bug bounty hunter.

How secure coding guidelines evolve

Equifax security issues uncovered in 2016

The difficulty with patching deserialization vulnerabilities

Root cause of Equifax hack is web app vulnerability

National Cybersecurity Awareness Month: More than a phishing expedition

Expert Interview: Infrastructure as Code with Oscar Quintas

COVID-19 contact tracing: What's the secure coding situation?

OWASP AppSec Day 2019: Nurturing Secure Developers

Contextual, Hands-On Learning: The Supercharged Way to Train Your Brain for Security

Best of the Brunch: Our Leaders in AppSec Share Their Wisdom

Security' is Not a Dirty Word: How a Positive Approach Will Transform Your Security Program

Why financial institutions are leading the charge to upskill their developers in secure coding

Celebrating International Women in Engineering Day: Meet Lucy

Sensei Product Update - March 2021

Try This Online Java Gotchas Quiz

Introducing Missions: The next phase of developer-centric security training

Sensei Product Update - September 2020

What is Sensei?

Strike first, strike hard: Why curated secure coding courses extend no mercy to cyber threats