$BLOG_TITLE

🦗 There hasn’t been a post here in years and I really should do something about this, but in the meantime here are my slides for my BSides Dublin 2026 talk Fighting Fire with Fire: Using AI to Scale Your Product Security Team https://docs.google.com/prese…

When you want to quickly grep for something but the pattern is too elaborate, Semgrep comes in really handy.

When reverse engineering an application that is shipped as compiled bytecode (jar file, war file, class files, etc.), we normally use a decompiler and then audit the resulting Java code.

When the same data is parsed twice by different parsers, some interesting security bugs can be introduced.

Regular expression injection is a common bug that doesn’t get talked about a lot.

Depending on how permissions are validated, it’s possible to find some fun authorization issues in GraphQL APIs.

These are links that I found interesting as I was (and still am) learning about Android application security and I’m putting it here in case it can help someone else!

Nahamsec has an excellent presentation about recon in which he discusses, among many other things, the topic of “Digital Dumpster Diving” and google dorking.

I’ve been a software developer for about 8 years, but as of last month I’ve made the switch to infosec and now I’m a security engineer on the application security team at GitLab.

Firebase Remote Config is a service that allows developers to host and easily modify settings for their mobiles apps.