Blog
Security articles on application code, Salesforce orgs and AI coding agents.
How orgs and applications actually get attacked, how attack paths are built, and how to get more security analysis done with fewer tokens. RSS
Application security9 Oct 20268 min readIDOR prevention in Express and NestJS: ownership checks that holdIDOR prevention for Express and NestJS: scope every lookup to the caller, where guards help and where they don't, Prisma where clauses, and tests that catch it.Read the post →Salesforce9 Oct 20269 min readSalesforce DevSecOps: a security pipeline for Apex, LWC and FlowsA Salesforce DevSecOps pipeline for Apex, LWC, Flows and metadata: pre-commit checks, pull request scans that gate on new findings, SARIF and live org scans.Read the post →Research9 Oct 202611 min readThe attacks of 2025, and the checks that flag their root causesTwelve attacks and disclosures from 2024 to 2026, the weakness in code or config behind each, and the Vulkro check that flags that weakness.Read the post →Compliance8 Oct 20268 min readAir-gapped SAST: what offline code scanning really needsAir-gapped SAST needs more than a local binary: no outbound calls, a fail-closed switch, an offline licence and vulnerability data you carry in. A checklist.Read the post →Supply chain8 Oct 20267 min readImported is not reachableA vulnerable Go module in go.mod is not the same as vulnerable code you run. How Vulkro checks each Go advisory against the exact function it names.Read the post →AI coding agents8 Oct 20267 min readWhat did the agent's edit break?An agent changes a signature and misses a caller. vulkro ctx check lists broken call sites, removed names still used, syntax errors and tests to run, before you commit.Read the post →AI coding agents7 Oct 20267 min readGive AI coding agents the code, not the whole fileAI coding agents read whole files to find one function. vulkro ctx answers with just the code that answers: one declaration, every usage, what depends on a name.Read the post →Application security7 Oct 20268 min readNext.js server actions are public endpointsA 'use server' function can be called by anyone who sends a POST. Why the auth check belongs inside every action, why middleware alone is fragile, and what to check.Read the post →Token efficiency7 Oct 20268 min readSecurity analysis without wasting tokensAn AI agent that reads your repository to find vulnerabilities spends its context on files that are not the answer. Hand it the finding and the lines instead.Read the post →Salesforce6 Oct 202610 min readAnatomy of a guest user data leakHow an anonymous Experience Cloud visitor ends up reading private records, hop by hop through site, guest profile, sharing and Apex, and how to close it.Read the post →Application security6 Oct 20266 min readOne engine for Salesforce and the rest of your stackThe Node, Python, Go and Java services around a Salesforce org are part of the same attack path and need the same analysis: routes, ownership and proof.Read the post →Supply chain6 Oct 20268 min readSecrets in git history: why deleting the line is not enoughA key deleted in the next commit still lives in git history, every clone and every fork. Rotate first, weigh a history rewrite, and stop the next one early.Read the post →