VulnCode @VulnCode_

Half the architecture hangs on questions nobody thinks to ask. We built a stage around them. It's called Discovery — the questions before the questions. Stage one of Pre-Code. vulncode.tech #PreCode #appsecurity #webdev

Never-do answers change scope. A feature that violates one gets cut or reworked. That argument costs an hour in week one. The same argument in month three costs the rework.

Every discovery phase asks the same questions. What are we building. Who's it for. What's in scope. What does it cost. What must it never do? That one isn't on the list. It comes before the list — and in most kickoffs it never gets asked.

Notice what all four have in common: you're asking your app for something you shouldn't get. The test isn't whether it works. It's whether it knows how to say no. All clean? Save this, rerun after every big change. vulncode.tech #appsecurity #webdev

3. View your page source. Search for "key", "secret", "sk-". Everything your frontend ships is public, readable code. 4. Open your database console. Find the access rule. If it reads "public," or there's no rule — that's the whole finding

Your app gets attacked before it gets its first user. Clean servers, put online, unannounced — first attack: 52 seconds. (Real Sophos experiment, decoy cloud servers.) Here's a self-audit worth two minutes. Four checks, zero security background, just a browser

Ask any team you're considering — us or anyone else: "What happens before the code?" If there's no name for it, that's the answer. Ask us about Pre-Code. Or ask your current team — both answers are useful. vulncode.tech #PreCode #webdev

This industry names its methods after speed. Sprints. Velocity. Shipping. Nobody names the thinking. What those first two stages produce doesn't screenshot well, either — answered questions. The kind that cost a week apiece when nobody asks them

Every build we've ever seen fails the same way — not in the code. Before it. That's why our process doesn't start there either. Pre-Code. The name of our entire process. Five stages — the name comes from the first two

Ask any team you're considering — us or anyone else: "What happens before the code?" If there's no name for it, that's the answer. Ask us about Pre-Code. Or ask your current team — both answers are useful. vulncode.tech #PreCode #webdev

This industry names its methods after speed. Sprints. Velocity. Shipping. Nobody names the thinking. What those first two stages produce doesn't screenshot well, either — answered questions. The kind that cost a week apiece when nobody asks them

Auth checks who you are. Access checks if this is yours. Apps forget the second one — and nothing breaks when they do. No errors, no alarms. Sources: OWASP Top Ten: owasp.org/www-project-to… IDOR Prevention: cheatsheetseries.owasp.org/cheatsheets/In…

Log in to your app. Change one number in the URL — order ID, user ID, whatever's there. Someone else's data loads. That's not a login bug. That's a missing check: "is this yours?" #1 on OWASP's 2025 Top 10. Check yours.

On Aug 4, keyv (150M+ weekly downloads) took a malicious commit at 09:02 UTC. Live on npm by 09:35. Spread across the Cacheable family by mid-morning. Full teardown by Datadog Security Labs: securitylabs.datadoghq.com/articles/npm-w…

npm ci, not npm install. One word in your CI config decided whether last month's npm worm reached your build. npm install re-resolves to the newest version that fits — even a malicious patch bump. npm ci installs exactly what's in your lockfile, or fails. Check yours.

Sources: 74 AI-attributed CVEs, rapid monthly growth: Cloud Security Alliance / Georgia Tech Vibe Security Radar, March 2026 45% of AI-generated code contains OWASP Top 10 vulnerabilities: Veracode 2025/2026 reports "Hallucinated bypass" pattern: CSA Research

Here's how: we don't just ask "where's the bug?" We ask "what did the AI assume it didn't need to check?" Did it trust the client to self-validate? Assume the DB was only reachable via the API? Drop a rate limiter for the happy path? That's what a real review catches.

AI can write working code in seconds. But it doesn't always know why a security check exists — so sometimes it just... removes one. 74 confirmed CVEs in AI-generated code by March, and climbing. We review AI code differently because of this. #AISecurity #AppSec