Appsec

REA (Reverse Engineer Anything) is an open-source GitHub MCP server for AI-driven reverse engineering of apps and binaries. What the repo does, how to use it, and the defender's take.

A resource worth knowing about: webhacklist.com, the Web Hacking Techniques Index. It is a free, open archive of 1,100+ web-hacking techniques from 2006 to today — the catalogue behind the community’s annual "Top 10 Web Hacking Techniques" — each entry preserved as Markdown and PDF with Wayback backups so the research survives even when the original blog goes offline. Here is what it is, who built it, how its "Museum", Library and Time Machine views work, and how an AppSec team or security leader can actually use it.

Phishing detection APIs score URLs, domains and emails for phishing risk in real time. What they check, where they fit in email and app security, and how to evaluate them.

URL reputation APIs return a risk signal for a web link — malware, phishing, spam or suspicious hosting. What they check, how they differ from IP reputation, and how to use them safely.

Threat intelligence APIs provide programmatic access to indicators, reputation data and context about threats. What free options can do, where they fit, and how to use them well.

IP reputation APIs tell you whether an IP address is associated with malicious activity. What they check, where they fit in a security stack, and how to evaluate free and paid options.

The npm ecosystem is a top target for supply-chain attacks. How to scan npm packages for security risk — known vulnerabilities, malicious packages, and provenance — and build it into your workflow.

OWASP AISVS (AI Security Verification Standard) is a checklist of testable requirements for securing AI and LLM apps. What it covers and how to use it.

Breach-lookup APIs let you check whether an email, domain or password has appeared in a known data breach. What the free options can and cannot do, safe ways to use them, and where they fit.

Searching for an application security free trial? PlayCISO has no no-card trial — but it does give you genuinely free, no-signup AppSec tools to run right now: an MCP server risk check, a prompt injection scanner, an identity risk calculator and a local LiteLLM IOC scanner.

A maintainer account compromise poisoned keyv, flat-cache, file-entry-cache and the rest of the family, then spread to 868 more packages across 1,381 versions — over 2 billion monthly installs. The releases were signed by GitHub Actions and the provenance checks out. That is the part worth your attention.

Researchers say Kimi K3 agents chained a Redis streams double-free with a RedisBloom heap overflow into working authenticated RCE, with one exploit produced in 27 minutes. Redis shipped seven security releases in response. The claims are self-reported — but the patches are real.

Claude Security is a new beta plugin that scans code changes or entire repos for high-severity vulnerabilities directly in the terminal — reasoning through data flows like a security researcher instead of pattern-matching, with adversarial self-checks to cut false positives. Here's how it works and what it means for AppSec teams.