Blog
Security articles on application code, Salesforce orgs and AI coding agents.
How orgs and applications actually get attacked, how attack paths are built, and how to get more security analysis done with fewer tokens. RSS
Salesforce17 Oct 20268 min readThree Apex details security scanners get wrongApex ignores case, an access check guards one operation and not a path, and escaping one piece of a query does not make it safe. Vulnerable and fixed code for each.Read the post →Application security17 Oct 20267 min readProven, unproven, not checked: three honest answersA scanner finding is a claim. Vulkro labels each one proven, unproven or not checked, keeps Critical and High for proof, and never treats an empty proof as safe.Read the post →AI coding agents16 Oct 20268 min readAn AI bill of materials, built from your codeWhich LLM SDKs, models, model files and MCP servers does your code use? Vulkro's --format aibom lists them with file and line, and maps findings to the OWASP AI lists.Read the post →Developer workflow16 Oct 20268 min readSecurity gate in CI: fail on new findings, not old debtA security gate in CI that fails on every finding gets switched off. How to gate on what a change added, with exit codes, baselines and hooks teams keep on.Read the post →Supply chain16 Oct 20267 min readRanking dependency alerts by real riskA CVE in a test runner is not a CVE in production. How Vulkro orders dependency findings by what ships, what is exploited and what your code reaches.Read the post →Application security15 Oct 20268 min readBroken access control is still number one, and 2025 showed whyChange one number in a request, get someone else's record. The IDOR breaches behind the 2025 headlines, and how Vulkro finds them in code and in Apex.Read the post →Supply chain15 Oct 20269 min readSBOM and VEX explained: the inventory and the verdictSBOM and VEX explained: what CycloneDX and SPDX record, what each VEX status and not_affected justification means, and the evidence that makes a VEX credible.Read the post →Application security15 Oct 20268 min readThe sign-in that never checks the signatureDecoding a JWT is not verifying it. Why jwt.decode and verify_signature False turn every protected endpoint into a public one, and how Vulkro reports it.Read the post →Compliance14 Oct 20268 min readCERT-In SBOM guidelines: what version 2.0 asks for, and how to checkThe CERT-In SBOM guidelines (v2.0, July 2025): who they apply to, the 21 minimum data fields, the VEX statuses, and how to generate and check a compliant SBOM.Read the post →AI coding agents14 Oct 20268 min readSecuring AI coding agentsAI coding agents write code faster than anyone can review it. How to stop them shipping vulnerabilities: an MCP server, a skill and a hook that checks each file as it is written.Read the post →Application security14 Oct 20268 min readThe missing tenant columnIn multi-tenant SaaS, one query without a tenant filter shows a customer someone else's data. Where cross-tenant leaks come from, and how to make scoping structural.Read the post →