Vibe Coding
Andrej Karpathy coined the phrase "vibe coding" in February 2025: describe what you want, let AI generate the code, "forget that the code even exists." Roughly eighteen months later, the industry has its answer to what happens when you ship a lot of code that nobody
LLM Red Teaming
LLM applications shipped fast, mostly without a security review, and the attack surface has been catching up ever since. Prompt injection now sits at the top of OWASP's LLM Top 10 for the second consecutive year. Agentic systems with the ability to call functions, browse the web, and
API Security
APIs are where modern applications actually live and where most of the significant security vulnerabilities are found. A web application pentest that doesn't explicitly include your API surface isn't testing the majority of your attack surface. It's testing the interface in front of it.
OWASP Top 10
Last verified: June 2026 The current OWASP Top 10 version is the 2021 edition. OWASP has not released a new Top 10 for web applications since 2021. If you've been told your web application pentest should be "OWASP-aligned" and almost every RFP says this you probably
Web App Penetration Testing
If you're evaluating web application penetration testing providers, you've probably already realised that the market is full of firms offering "pentests" that aren't really pentests automated scanner runs dressed up with a cover report. This guide is written for the people making