Medium

MediumIamarbaz – Medium

Iamarbaz

him

Iamarbaz

·

5d ago

Guardrails That Actually Hold: A Year of LLM Firewall Deployments

Most teams build their first LLM guardrail the same way. They write a paragraph into the system prompt that says, in effect, please do not…

Guardrails That Actually Hold: A Year of LLM Firewall Deployments

Iamarbaz

·

5d ago

A hands-on look at the agent attack vector already showing up in CVEs.

A hands-on look at the agent attack vector already showing up in CVEs.

A hands-on look at the agent attack vector already showing up in CVEs.

Iamarbaz

·

Nov 6

Solo Founders Cannot Be Secure at Launch. They Can Know What They Skipped.

Imagine launching today and waking up tomorrow to one of these numbers: a potential $5 million privacy penalty, a $1 million cloud bill, 43…

Solo Founders Cannot Be Secure at Launch. They Can Know What They Skipped.

Iamarbaz

·

Nov 6

Before You Ship an AI Feature: A Founder’s 2-Hour Threat Model

You are adding an AI feature this sprint. A chatbot, an agent that takes actions, a summarize-my-data button, something. It is going to…

Before You Ship an AI Feature: A Founder’s 2-Hour Threat Model

Iamarbaz

·

Oct 27

6 of 8 SVG Sanitizers Got Broken: How a "Safe" Image Upload Can Run JavaScript (SVG XSS)

A beginner-friendly breakdown of PortSwigger's SVG XSS research: namespace tricks, XSLT, a Firefox header bug and a GIF that becomes SVG.

6 of 8 SVG Sanitizers Got Broken: How a "Safe" Image Upload Can Run JavaScript (SVG XSS)

Iamarbaz

·

Oct 21

Enumerating Active Directory with ldeep: a hands-on field guide

A practical walkthrough of LDAP post-exploitation enumeration, from first bind to Domain Admin.

Enumerating Active Directory with ldeep: a hands-on field guide

Iamarbaz

·

Oct 18

The $25M Deepfake Call Was a Process Failure, Not a Tech Problem

In early 2024, an employee at a finance firm in Hong Kong joined a video call with several senior executives. The faces were right. The…

The $25M Deepfake Call Was a Process Failure, Not a Tech Problem

Iamarbaz

·

Oct 18

Everyone Is Shipping AI. Almost Nobody Is Shipping Value.

MIT says 95% of enterprise AI pilots produce no measurable return. Here’s the gap I keep watching teams fall into.

Everyone Is Shipping AI. Almost Nobody Is Shipping Value.

Iamarbaz

·

Oct 18

The One-Person Unicorn Is Real. It’s Also a Trap.

Staying tiny with AI is a genuine superpower. It’s also how you build a company that can’t survive you.

The One-Person Unicorn Is Real. It’s Also a Trap.

In

Towards AI

by

Iamarbaz

·

Oct 13

Your AI Coding Assistant Is an Insider Threat

Look at what your coding agent can reach right now. It has read access to your entire repository. It can see your .env file. It can run…

Your AI Coding Assistant Is an Insider Threat

Iamarbaz

Iamarbazhim

Breaking apps, APIs & networks for a living. Offensive security, red teaming & LLM hacking. I find the holes before the bad guys do. 🥷💻

Following

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech