Piyush Kumawat
Posts from SecurityCipher.
AI-Generated Code Security Bugs: A Vibe Coding Case Study
Vibe-coding a pentest findings dashboard, then reading the helpers: f-string SQL, no owner check, a token in source, MD5, a path escape,…
Cloud Misconfig Bounty Hunting in 2026: Open Buckets, Firebase, and Secrets
Practical cloud misconfig bounty playbook: wordlist probing, open S3/GCS/Azure listings, Firebase dumps, nuclei, and gitleaks on PoC dumps - with real terminal…
DevSecOps From Laptop to Production: A Practical Security Pipeline Guide
How software travels from a developer’s editor to a live server – and where security checks sit along the way. Every tool…
The CVE Flood Is a Lie: How to Hunt When AI Dumps 36% More Bugs But Exploitation Only Grows 10%
Your vulnerability scanner ran overnight. Your inbox has 47 new CVE alerts. Slack is pinging you about a “critical” flaw in a…
RAG Poisoning in 2026: A Practical Playbook for Hacking Answers Through Your Knowledge Base
Your support bot knows the refund policy. Your internal copilot cites the employee handbook. Your sales assistant pulls answers from a folder…
Secrets That Pay: Hunting Valid Credentials with TruffleHog for Bug Bounties
Most secret scanners dump hundreds of high-entropy strings and leave you to guess which ones still work. That is a terrible way…
Software Supply Chain Security in 2026: Packages, Pipelines, and Provenance
Most teams still treat supply chain security like a compliance checkbox: generate an SBOM once a quarter, turn on Dependabot, call it…
I Ran Codex Security on a Shop API Lab: 14 Bugs, $1.64, Full Playbook
Hands-on OpenAI Codex Security CLI guide: scan a Flask shop API, get 14 findings, threat model, remediations, GitHub bulk-scan, and a real…
How I Would Hack Your Startup in 24 Hours (Real-World Pentest Guide)
Give me your company name and 24 hours. That is usually all it takes to go from knowing nothing about a startup…
Web Cache Poisoning in 2026: A Practical Playbook (One Request, Every Victim)
Most web bugs hit one victim at a time. Web cache poisoning is different, and that is exactly why it is worth…