Understanding security issues

Weaknesses in how users prove their identity, including weak passwords, missing multi-factor authentication, insecure session handling, and authentication bypass vulnerabilities.

Flaws that let users act outside their permissions, letting them read, update, or delete resources they shouldn't.

Attackers are able to degrade or deny service availability, including things like: algorithmic complexity attacks, lack of rate limiting, and resource exhaustion.

Therse are vulnerabilities in the application's business rules and workflows that allow attackers to abuse legitimate functionality in unintended ways, like bypassing pricing, manipulating workflows, or exploiting race conditions.

Vulnerabilities in web applications that allow attackers to execute malicious actions in users' browsers, including script injection, request forgery, UI manipulation, and cross-origin policy bypasses.

Mistakes when setting up cryptography that lead to broken, weak, or misconfigured cryptography, or disabling it entirely and can leave users exposed.

Vulnerabilities where untrusted user input is interpreted as code or commands, allowing attackers to execute arbitrary queries, system commands, or code in the application context.

A class of vulnerabilities related to AI and Large Language Model applications, including prompt injection, data extraction, model manipulation, insecure integrations, and resource abuse.

Vulnerabilities in server-side processing and network interactions, including server-side request forgery, HTTP protocol exploits, insecure file operations, and path traversal attacks.

Vulnerabilities in third-party dependencies, build pipelines, container images, cloud configurations, and development environments that can compromise applications before they even run.