How to Think About the Difference Between Choice and Score in Jev
One thing that has been tripping me up with Jev is the difference between choice and score. I keep mixing them up. I finally took…
Category: Mix
From sceptic to supercharged. How AI changed my day as a QA Engineer
When the push came to start weaving AI into our everyday work, I had doubts at the start. But I have since come around, and…
Your Agents Should Have Names
With AI capabilities improving so fast I’m starting to think more about something I wrote about a couple of years ago. Multiple persistent agents that…
My Early Thoughts on Jev
Okay, I’ve got a video coming out, but here are my early thoughts on Jev. The first thing to know is that it’s not a…
![[tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards](https://image.cybernoz.com/wp-content/uploads/2026/09/tldr-sec-346-Can-AI-Do-Novel-Security-Research-600x340.png)
[tl;dr sec] #346 – Can AI Do Novel Security Research?, Anthropic’s Threat Intel Report, How Cloudflare Enforces Engineering Standards
I hope you’ve been doing well! Improv Friends I had a somewhat bittersweet dinner with one of my (musical) improv comedy teams recently. We’ve been…
AI Agent Security Readiness: The Federal Standard You Should Get Ahead Of
Here’s the uncomfortable part first: in August 2026, researchers found AI agents connected to Hugging Face running loose inside enterprise networks. No owner, no audit…
Bypassing Apple’s iOS 10 Restrictions Settings – Twice — Jon Bottarini
By default, Apple has a feature that allows all of their iOS devices to be assigned restrictions, so that employees and mostly children cannot access…
Discovering a stored XSS that affects over 900k websites (CVE-2016-9751) — Jon Bottarini
In my free time when I’m not hunting for bugs in paid programs, I like to contribute a bit to the open-source community and check…
XSS vulns galore (plus a cool shirt!) — Jon Bottarini
When the adult website PornHub launched their public bug bounty program, I was pretty sure that most of the low hanging fruits of vulnerabilities would…
Inspect Element leads to Stripe Account Lockout Authentication Bypass — Jon Bottarini
A common thing I see happening with many popular applications is that a developer will disable an HTML element through the “class” attribute. It usually…
Abusing internal API to achieve IDOR in New Relic — Jon Bottarini
I recently found a nice insecure direct object reference (IDOR) in New Relic which allowed me to pull data from other user accounts, and I…
Get as image function pulls any Insights/NRQL data from any New Relic account (IDOR) — Jon Bottarini
This writeup walks you through the full process as to how I found a pretty bad Insecure Direct Object Reference (IDOR) in New Relic. In…