Piyush Kumawat
Posts from Security Cipher.
Secrets That Pay: Hunting Valid Credentials with TruffleHog for Bug Bounties
Most secret scanners dump hundreds of high-entropy strings and leave you to guess which ones still work. That is a terrible way…
Software Supply Chain Security in 2026: Packages, Pipelines, and Provenance
Most teams still treat supply chain security like a compliance checkbox: generate an SBOM once a quarter, turn on Dependabot, call it…
I Ran Codex Security on a Shop API Lab: 14 Bugs, $1.64, Full Playbook
Hands-on OpenAI Codex Security CLI guide: scan a Flask shop API, get 14 findings, threat model, remediations, GitHub bulk-scan, and a real…
How I Would Hack Your Startup in 24 Hours (Real-World Pentest Guide)
Give me your company name and 24 hours. That is usually all it takes to go from knowing nothing about a startup…
Web Cache Poisoning in 2026: A Practical Playbook (One Request, Every Victim)
Most web bugs hit one victim at a time. Web cache poisoning is different, and that is exactly why it is worth…
Is AI Killing Bug Bounty? What the 2026 CVE Flood Really Means for Hunters
Ask any bug bounty hunter how 2026 is going and you will get one of two answers. Either “I have never found…
AI Pentest Tools in 2026: What Actually Works (T3MP3ST, PentestGPT, Caido and More)
Half the bug bounty writeups on my feed this week were not about a new vulnerability class – they were about a…
LLM Red Teaming in 2026: A Practical garak + PyRIT Workflow
You shipped an LLM feature. A support chatbot, a “summarize this document” button, an agent that can call tools. Now the obvious…
Indirect Prompt Injection in 2026: Hacking AI Through the Content It Reads
Most people picture prompt injection as someone typing “ignore your instructions” into a chatbot. That is the direct kind, and it is…
Hacking GraphQL APIs in 2026: Introspection, BOLA, and Batching Attacks
GraphQL is a gift to attackers. One endpoint, usually /graphql, that speaks a typed, self-describing language and will happily tell you every…