Profile avatar
raybeorn.bsky.social
Life Coach, Conspiracy Theorist, and Absurdist. I do AppSec in my non-spare time for money. My opinions are now your opinions, but at least you are now right!
42 posts 35 followers 79 following
Regular Contributor
Active Commenter

Everyone is like rip tiktok but more like rip my feed.

I am happy that appsec peeps aren’t talking about bug bounty and threat modeling all the time. I wonder what the next big buzzword is gonna be for appsec.

Design a system that is PCi/HITRUST/Whatever compliant but it is vulnerable af.

Was not a fan of compliance but now I am starting to see the merits in some cases.

Damn, it’s been a while since I’ve been on here

Join @semgrep community for a live panel on "Building a Successful Security Champions Program: What Does it Take?" with AppSec veterans Chris Romeo @edgeroute, Dustin Lehr @DustinLehr1, Devin Rudnicki, and Ray Leblanc @Raybeorn ow.ly/WngS50QBpRN #SecurityChampions #AppSec

We have done bug bounties, DevSecOps, now threat modeling. Are we secure yet?

I use to be a big believer in SCA but now I feel like we should start a crusade against it. Not all of it but most of it. How many wasted dev hours have gone into fixing pointless shit?

When are chain wallets going to be cool again? I just found my old one. I think im gonna wear it

App Security architects what KPIs do you use to show you are doing architectural work?

Want to level up your threat modelling skills? Join us for an eye-opening conversation with @Raybeorn and host @shehackspurple, on the We Hack Purple podcast! WHP: https://wehackpurple.com/podcast/episode-80-with-ray-leblanc/ #YouTube: https://youtu.be/q20AXw6gv0o Sponsored by #semgrep

I'm speaking at #ThreatModCon Oct 29th in Washington, DC, and the CALL FOR PAPERS is open! "Threat Modeling is for Everyone", CFP closes July 15th, get going! https://www.threatmodelingconnect.com/general-discussion-32/call-for-papers-threat-modeling-conference-2023-238

Just checked out the MASVS, i like the new version.

So i took the ASVS, got it down to under 50 controls. Decided whether the controls could be tested thru automation or manually. This will be the start of my api security standard.

Is the OWASP Top 10 for LLMs really valid if it wasn’t generated by LLMs?

I have arrived.