A Prompt Is Not a Security Function
How one finding illustrates the need for people, process, technology -- and whether we can automate the bigger picture
Jul 7, 20266 min read
Command Palette
Search for a command to run...
Latest articles
Exploit Verification
Today marks an exciting day for all of us here at Pixee, and maybe in appsec? Excuse me some founder panaché. The Problem: Proving Exploitability Is Hard One of the hardest, most detail-oriented, and time consuming things to do with SAST is to try to...
Jul 22, 20254 min readSAST is just crazy bad at XSS
XSS is one of the more serious things in appsec, and it's pretty prevalent. It’s also one of those things that is super hard to find accurately via static analysis. And, vendors don’t want to miss it — so, typically any data that gets to a response, ...
Jul 10, 20254 min read"LLMs Can't Reason"
The top post on HN right now (well, yesterday) is about speaking more directly in the age of LLM "fluff". I have nothing to say about the piece’s main points. But, a sentence caught my eye that never seems to receive any pushback: While it's true th...
Mar 31, 20253 min readModel providers give good advice for a change
Maturity around tools, practices is getting better
Dec 30, 20243 min read
A note from the AI front lines
AI rightfully refuses to relinquish its place in our cultural conversation, and so I thought I'd share a few interesting things we've noticed at Pixee making an AI product security engineer. I hope that others might find validation, understanding, or...
Sep 25, 20243 min readWait, you don't send fixes to the IDE?
Wait, you don't send the fixes into the IDE? When I first tell people at Pixee that we send Pull Requests (or Merge Requests, for your GitLabers) to fix vulnerable code, they always look at us quizzically for a second -- whether they be partners, pr...
Sep 4, 20243 min read
Sustained Attention Fatigue in Vulnerability Analysis
The predominant hobby of my teenage years and the main focus of my first 10 years of my career was a mix of very similar activities: code review, bug hunting, exploit development, and building scanners/reviewing scanner output. One particularly inten...
Jul 29, 20246 min readWhy you never heard of codemods and why that should change
Almost no one in my engineering circles uses codemods. Few of them have heard of them, and even fewer use them. Codemods are cool, so why is that? If you’re of the small number of people that know about codemods, feel free to skip the next section an...
Jan 23, 20247 min read