#information leakage scanning
30 related articles
·2 min
Complete Analysis of MCP Protocol Security Attacks: 16 Threat Types Across a Four-Stage Lifecycle
Systematic breakdown of MCP protocol's four-stage lifecycle and 16 security attack types, covering supply chain poisoning, prompt injection, credential theft, and more real-world threats.
Read more →
·5 min
OpenAI Open-Sources Codex Security: An In-Depth Review of the AI Security Scanning Tool's Strengths and Limitations
In-depth analysis of OpenAI's open-source Codex Security code scanning tool, comparing it with Snyk, Semgrep, and CodeQL, examining its AI Agent verification, real test data, and current limitations.
Read more →
·3 min
Tencent Open-Sources AI-Infra-Guard: A Deep Dive into the Full-Stack AI Red Teaming Platform
Deep dive into Tencent's open-source AI-Infra-Guard full-stack AI red teaming platform, covering Agent scanning, MCP protocol scanning, LLM jailbreak evaluation, and more.
Read more →
·4 min
Getting Started with SRC Bug Bounties: Can You Find Vulnerabilities Without Knowing How to Code?
A beginner's guide to SRC bug bounties: learn how to find business logic, information leakage, and weak credential vulnerabilities using Burp Suite without coding skills.
Read more →
·3 min
Aegisora: A Deep Dive into the Open-Source Security Control Layer for AI Agents
Deep dive into how open-source project Aegisora provides runtime security controls for AI agents, including malicious behavior interception, least-privilege API access, real-time PII redaction, and audit logs.
Read more →
·3 min
Claude Package Hallucination Vulnerability: AI Generates Fake Dependency Packages That Steal Real API Keys
Anthropic's Claude generates nonexistent package names during coding assistance, which malicious actors register to steal real API keys. Analysis of the attack chain and developer defenses.
Read more →
·3 min
Scanning 7.6PB of HuggingFace Data: A Hidden Key Crisis in AI Training Sets
A security audit of 7.6PB of HuggingFace training data uncovered massive API key and credential leaks. Analysis of risks, scanning challenges, and data supply chain security governance.
Read more →
·2 min
Tokimeter: Open-Source Local Token Usage & Cost Analyzer for AI Coding Tools
Tokimeter is an open-source local tool that unifies token usage and cost analysis across Claude, Cursor, Codex, and more AI coding tools—no account needed, data never leaves your machine.
Read more →
·6 min
Separate Domains vs. Subdomains for Self-Hosted Services? A Deep Dive into Security Isolation Strategies
Deep dive into domain security architecture for self-hosted services: Should services with different exposure levels use separate domains or subdomains? Analysis of subdomain enumeration risks, defense in depth, and practical isolation strategies.
Read more →
·3 min
VulX Watch: A Standalone Security Audit Tool Built Specifically for AI-Generated Code
VulX Watch is a security audit tool for AI-generated code that connects read-only to GitHub repos, independently reviews vulnerabilities, and provides line-level evidence for every finding.
Read more →
·4 min
Mysterious URL Requests in NGINX Logs? Unmasking Automated Scanning Attacks and How to Defend Against Them
Seeing strange 404 requests and bizarre URLs in your NGINX access logs? Learn what automated scanning attacks are, where they come from, and how to defend with Fail2ban, CrowdSec, and other practical solutions.
Read more →
·4 min
Strange URL Requests in Your NGINX Logs? Demystifying Automated Scanning Attacks and Defense Methods
Seeing unfamiliar 404 requests and strange URLs in your NGINX logs? This article explains automated scanning attacks—their origins, intent—and provides practical defenses using Fail2ban, CrowdSec, and more.
Read more →
·3 min
Discovering Cryptographic Vulnerabilities with Claude: A New Paradigm for AI-Assisted Security Research
How Anthropic's Claude assists in discovering cryptographic implementation vulnerabilities, analyzing AI's real capabilities and limitations in code review, side-channel detection, and protocol analysis.
Read more →
·3 min
Self-Hosted Receipt Tracking Tools: Monitoring Grocery Expenses and Price Changes
Explore self-hosted receipt tracking tools for grocery expense management, covering OCR recognition, price tracking, food categorization, and budget management with open-source solutions like Firefly III.
Read more →
·3 min
Claude Code in Practice: How AI Coding Tools Can Protect Your Secret Keys
When AI coding assistants have full filesystem access, are your API keys and cloud credentials safe? Deep dive into secret leakage risks and practical defenses.
Read more →
·5 min
Practical Guide to Deploying Invoice Analysis AI: Model Selection and Architecture Pitfalls
How can enterprises process 50+ invoice formats with AI? This article analyzes visual document understanding approaches—multimodal LLMs, OCR+LLM, and hybrid architecture—with key decision advice for non-technical AI leads.
Read more →
·5 min
Security Swarm Evaluation in Practice: Validating AI Security Tools with Real Vulnerabilities
A deep dive into Security Swarm's evaluation methodology: building test sets from real, recent vulnerabilities to avoid training data contamination and validate its ability to find more bugs at lower cost.
Read more →
·6 min
Alibaba Bans Claude Code: The Enterprise Security Red Line for AI Coding Tools
In-depth analysis of Alibaba's comprehensive internal ban on Claude Code: from the hidden-marker controversy and Anthropic's regional-restriction stance to five core questions of enterprise AI coding tool security admission.
Read more →
·4 min
AirDrop and Quick Share Security Vulnerabilities: Hidden Risks in Wireless Transfer Protocols
A deep dive into AirDrop and Quick Share wireless transfer protocol security — covering device discovery, handshake auth, data parsing attack surfaces, and practical defense recommendations.
Read more →
·7 min
Building an AI Agent from Scratch: Implementing Core Conversational Agent Features in Python
Learn AI Agent development from scratch. This tutorial covers LLMs and prompts, then builds a conversational agent in Python using the DeepSeek API with multi-turn dialogue and system prompts.
Read more →