https://firewallsync.com/categories/appsec/Recent content in AppSec & APIs on FirewallSyncHugoen-usFirewallSyncThu, 01 Oct 2026 09:00:00 +0000https://firewallsync.com/posts/the-vulnerability-backlog-that-never-shrinks/Thu, 01 Oct 2026 09:00:00 +0000https://firewallsync.com/posts/the-vulnerability-backlog-that-never-shrinks/Vulnerability backlogs grow faster than teams can patch because most programs measure the wrong thing: total count instead of exploitability and exposure.https://firewallsync.com/posts/dependency-audits-without-slowing-down-releases/Tue, 29 Sep 2026 09:00:00 +0000https://firewallsync.com/posts/dependency-audits-without-slowing-down-releases/Most supply-chain security advice assumes you can afford to review every dependency by hand. Here’s a tiered approach that scales with a normal release cadence.https://firewallsync.com/posts/container-image-scanning-what-ci-pipelines-still-miss/Mon, 28 Sep 2026 09:00:00 +0000https://firewallsync.com/posts/container-image-scanning-what-ci-pipelines-still-miss/Image scanning in CI catches known CVEs in base layers, but most pipelines still ship vulnerable configs and secrets that scanners aren’t tuned to see.https://firewallsync.com/posts/the-api-key-mistakes-that-keep-making-breach-reports/Mon, 24 Aug 2026 00:00:00 +0000https://firewallsync.com/posts/the-api-key-mistakes-that-keep-making-breach-reports/Secrets scanning tools have gotten good. The breaches keep happening anyway, mostly for three preventable reasons.