Introducing, the new Secure Software Development Lifecycle!!!!!

🚀 Introducing aghast v0.7.1: Diff-scoped security scanning When you're reviewing a PR, you don't want to be flooded with findings from code that didn't change. v0.7.1 adds automatic diff filtering so aghast focuses its analysis on what actually changed. 1/4

Them: We need a super-sophisticated AI powered security review tool to stop vulnerabilities entering our products. Me: No, you just need to stop ignoring the security PR comments that your current AI reviewer is adding...

Live footage of anyone trying to do anything clever using the @ClaudeDevs AgentSDK 🤦‍♂️🤦‍♂️🤦‍♂️ #Anthropic #BaitAndSwitcha #Claude

OWASP Juice Shop v20 is here! 🍹 Featuring: AI/LLM-based chatbot (w/ 3 hacking + 2 coding challenges), redesigned storefront, ~30% faster startup time, Angular 21, neon-fire & lime-green theme, and much more! owasp.org/blog/2026/05...

Quiz! I submitted an Open Source Program application to @AnthropicAI to assist with my work on @OWASP_ASVS. (Don't quite meet requirements but thought I'd try) Did I get: a) Accepted onto the program b) No response c) Spam to the email address I used to register d) both b + c?

Having spent a bunch of time using Opus, I tried to economize last week by using Sonnet more. I feel like it makes more mistakes and needs more guidance, even if I get Opus to plan first. Starting to wonder whether the time incurred costs more than the token saving...

🚀 aghast v0.6.0 is out! Cost and budget controls, per-check repository exclusion, and enhanced security hardening. Run aghast stats to see your scan costs, set budgets, and scale with confidence. Get it: npm install -g @bouncesecurity/aghast #SecurityTesting #DevSecOps

Wearing my @Semgrep socks to celebrate as sorting by name finally comes to the Semgrep playground. Thanks Semgrep Hack Week!!!

I recorded a series of videos demonstrating different ways in which you can use #AGHAST. This is the 5th example where we take the units produced by a @Knostic OpenAnt scan and scan those units individually for vulnerabilities.

AGHAST - Walkthrough of Example 5

This video walks you through example 5 from the AGHAST documentation. Link to the explanation of this example: https://github.com/BounceSecurity/aghast/blob/main/docs/trying-it-out.md#example-5-various-security-vulnerabilities-targeted-check-openant-discovery-general-vulnerability-analysis Link to

youtu.be

I recorded a series of videos demonstrating different ways in which you can use #AGHAST. This 4th example takes a SARIF file simulating some generic SAST results and evaluates each finding to decide if it is a false positive.

AGHAST - Walkthrough of Example 4

This video walks you through example 4 from the AGHAST documentation. Link to the explanation of this example: https://github.com/BounceSecurity/aghast/blob/main/docs/trying-it-out.md#example-4-sast-finding-verification-targeted-check-sarif-input-false-positive-validation Link to the repository of

youtu.be

I recorded a series of videos demonstrating different ways in which you can use #AGHAST. This is the 3rd example which doesn't use AI at all but rather just a custom written static rule to find exposed API endpoints without authentication decorators.

AGHAST - Walkthrough of Example 3

This video walks you through example 3 from the AGHAST documentation. Link to the explanation of this example: https://github.com/BounceSecurity/aghast/blob/main/docs/trying-it-out.md#example-3-missing-api-token-decorator-static-check-semgrep-discovery Link to the repository of public examples: ht

youtu.be

I recorded a series of videos demonstrating different ways in which you can use #AGHAST. This 2nd video is a hybrid check using a static @Semgrep rule to find uses of a sensitive function and an AI prompt on each use to check for correct validation.

AGHAST - Walkthrough of Example 2

This video walks you through example 2 from the AGHAST documentation. Link to the explanation of this example: https://github.com/BounceSecurity/aghast/blob/main/docs/trying-it-out.md#example-2-important-validations-before-ai-queries-targeted-check-semgrep-discovery Link to the repository of publi

youtu.be

I recorded a series of videos demonstrating different ways in which you can use #AGHAST. This is the 5th example where we take the units produced by a @Knostic OpenAnt scan and scan those units individually for vulnerabilities.

AGHAST - Walkthrough of Example 5

This video walks you through example 5 from the AGHAST documentation. Link to the explanation of this example: https://github.com/BounceSecurity/aghast/blob/main/docs/trying-it-out.md#example-5-various-security-vulnerabilities-targeted-check-openant-discovery-general-vulnerability-analysis Link to

youtu.be

I recorded a series of videos demonstrating different ways in which you can use #AGHAST. This is the first one with a simple check that just uses an AI prompt to look for business logic being incorrectly enforced.

AGHAST - Walkthrough of Example 1

This video walks you through example 1 from the AGHAST documentation. Link to the explanation of this example: https://github.com/BounceSecurity/aghast/blob/main/docs/trying-it-out.md#example-1-business-logic-bypass-repository-check Link to the repository of public examples: https://github.com/Bou

youtu.be

I recorded a series of videos demonstrating different ways in which you can use #AGHAST. This 4th example takes a SARIF file simulating some generic SAST results and evaluates each finding to decide if it is a false positive.

AGHAST - Walkthrough of Example 4

This video walks you through example 4 from the AGHAST documentation. Link to the explanation of this example: https://github.com/BounceSecurity/aghast/blob/main/docs/trying-it-out.md#example-4-sast-finding-verification-targeted-check-sarif-input-false-positive-validation Link to the repository of

youtu.be

I recorded a series of videos demonstrating different ways in which you can use #AGHAST. This is the 3rd example which doesn't use AI at all but rather just a custom written static rule to find exposed API endpoints without authentication decorators.

AGHAST - Walkthrough of Example 3

This video walks you through example 3 from the AGHAST documentation. Link to the explanation of this example: https://github.com/BounceSecurity/aghast/blob/main/docs/trying-it-out.md#example-3-missing-api-token-decorator-static-check-semgrep-discovery Link to the repository of public examples: ht

youtu.be

I recorded a series of videos demonstrating different ways in which you can use #AGHAST. This 2nd video is a hybrid check using a static @Semgrep rule to find uses of a sensitive function and an AI prompt on each use to check for correct validation.

AGHAST - Walkthrough of Example 2

This video walks you through example 2 from the AGHAST documentation. Link to the explanation of this example: https://github.com/BounceSecurity/aghast/blob/main/docs/trying-it-out.md#example-2-important-validations-before-ai-queries-targeted-check-semgrep-discovery Link to the repository of publi

youtu.be

I recorded a series of videos demonstrating different ways in which you can use #AGHAST. There is the first one with a simple check that just uses an AI prompt to look for business logic being incorrectly enforced.

AGHAST - Walkthrough of Example 1

This video walks you through example 1 from the AGHAST documentation. Link to the explanation of this example: https://github.com/BounceSecurity/aghast/blob/main/docs/trying-it-out.md#example-1-business-logic-bypass-repository-check Link to the repository of public examples: https://github.com/Bou

youtu.be

Today, we are releasing AGHAST, an open source framework that combines static discovery with AI prompts to find repository-specific and company-specific security issues for accurate and economical analysis. 1/4

I think my local, multi git account setup has reached its final form (for now...), starting Microsoft Windows, 1Password and some help from Claude :) Check out details here:

Getting multiple GitHub accounts on one Windows machine – 2026 update

A guide on how to manage multiple GitHub accounts on a single Windows machine using 1Password and SSH host aliases, updated for 2026.

joshcgrossman.com

I think my local, multi git account setup has reached its final form (for now...), starting Microsoft Windows, 1Password and some help from Claude :) Check out details here:

Getting multiple GitHub accounts on one Windows machine – 2026 update

A guide on how to manage multiple GitHub accounts on a single Windows machine using 1Password and SSH host aliases, updated for 2026.

joshcgrossman.com

Be the first to attend my new training course at @OWASP Global AppSec Vienna! "Repeatable, Scalable and Valuable Code Security Scanning" is a deep dive into the newest ways to validate code security with a strong emphasis on AI acceleration. Register: owaspglobalappseceuv...

Be the first to attend my new training course at @OWASP Global AppSec Vienna! "Repeatable, Scalable and Valuable Code Security Scanning" is a deep dive into the newest ways to validate code security with a strong emphasis on AI acceleration. Register: owaspglobalappseceuv...

I'm sure this blogpost will be interesting to the two or three other people people in the world who are using Claude Code on Windows and want to have multiple accounts active :) Keen to hear feedback and experiences 😀

Running two Claude Code accounts on one Windows PC (without them fighting)

How I isolated Personal and Work Claude Code accounts on a single Windows machine by faking per-account home directories and a handful of symlinks.

joshcgrossman.com

I'm sure this blogpost will be interesting to the two or three other people people in the world who are using Claude Code on Windows and want to have multiple accounts active :) Keen to hear feedback and experiences 😀

Running two Claude Code accounts on one Windows PC (without them fighting)

How I isolated Personal and Work Claude Code accounts on a single Windows machine by faking per-account home directories and a handful of symlinks.

joshcgrossman.com

Starting off the year with the uno reverse card 🤣🤣🤣

LONDON, BABY! I'm bringing my course "Building a High-Value AppSec Scanning Programme" to London as part of @OWASP's London training days, 23-24 February 2026. As seen at OWASP Global conferences, @BlackHatEvents and @NDC_Conferences, don't miss your chance to attend!

#justaithings

CFTs for both @BlackHatEvents #BHUSA and @OWASP Global AppSec EU (Vienna) are now open and close in early December! Thinking of submitting? Check out my blog series for @BounceSecurity "So you want to train at Black Hat (or other conferences)?"