https://www.cgisecurity.com/ All things related to website, database, SDL, and application security since 2000. en-US 2025-06-01T00:10:15-07:00 https://www.cgisecurity.com/2025/06/announcing-sectemplatescom-release-6-security-partner-program-pack-v1.html I have built several security partner programs at companies such as Box Inc. and Coinbase, with over 8 years of experience leading them. I have consistently observed the benefits of a partner-focused model versus a classical consultancy model within medium to large enterprises. I'm pleased to announce our 6th program pack, the... Announcements Papers Rant Research Robert A. 2025-06-01T00:10:15-07:00 https://www.cgisecurity.com/2024/09/announcing-sectemplatescom-release-5-security-exception-program-pack-10.html The goal of this release is to provide all the necessary resources to establish and set up a fully functioning security exceptions program at your company. - Robert Auger (@robertauger) In this pack, we cover: Security Exception Definitions: This document describes common terminology used in an exceptions process, outlines definitions for the... Site News Vulns Robert A. 2024-09-21T16:33:59-07:00 https://www.cgisecurity.com/2024/08/sectemplatescom-release-4-vulnerability-management-program-release-pack-10.html I'm pleased to announce our fourth release, the Vulnerability Management Program Pack. The goal of this release is to provide everything you'd need to establish and setup a fully functioning vulnerability management program at your company. - Robert Auger (@robertauger) In this pack, we cover: Vulnerability Level Definitions: This document outlines vulnerability... Site News Vulns Robert A. 2024-08-05T10:36:35-07:00 https://www.cgisecurity.com/2024/07/announcing-sectemplatescom-release-3-bug-bounty-program-pack-10-.html Introduction There are numerous considerations beyond selecting a provider, many of which are often overlooked in public documentation. The goal of the Bug Bounty Program pack is to help people quickly ramp up on the topic, providing them with the necessary information to begin their journey and ultimately launch a program. -... Bug Bounty Robert A. 2024-07-08T17:13:57-07:00 https://www.cgisecurity.com/2024/06/announcing-sectemplatescom-release-2-external-penetration-testing-program-pack-10.html In addition to CGISecurity I work on other side projects from time to time. Below is my second announcement from my latest project. Introduction I have built out several penetration testing programs, both internally and externally at companies such as eBay, Paypal, and Box to name a few. Before you have the... Off Topic Papers Rant Site News Vendors Robert A. 2024-06-24T13:23:03-07:00 https://www.cgisecurity.com/2024/06/announcing-sectemplatescom-and-the-incident-response-program-pack-10.html In addition to CGISecurity I work on other side projects from time to time. Below is an announcement about my latest project. Introduction I've worked in the security industry for over 20 years and, during this time, have built and shaped many security programs. At every company I join, I find myself... Incidents Papers Rant Site News Robert A. 2024-06-18T12:45:31-07:00 https://www.cgisecurity.com/2020/11/20-years-of-cgisecurity-what-has-changed-within-the-application-security-space.html Just realized that 20 years have passed since I started this site to learn more about web security threats. What 'appsec' looked like in 2000 OWASP didn't exist yet, nor did WASC Vulnerability disclosure was the wild west. Rain forest puppy (RFP) (that guy who discovered sqli) had just created the first... Commentary Site News Robert A. 2020-11-22T02:03:41-08:00 https://www.cgisecurity.com/2018/05/my-experiences-leading-purple-team.html I've been fortunate enough to manage a red team program for several years and since it's inception it has gone through many changes. What started out as adhoc engagements trying to see how far we could get/what problems we could find, turned into a mechanism to work more closely, and regularly with... Blue Team Buzzwords Commentary Defense Forensics IndustryNews Purple Team Rant Red Team Research Vulns Robert A. 2018-05-29T11:22:43-07:00 https://www.cgisecurity.com/2017/05/oauth-nightmares-talk.html Two of my co workers have presented at HackMiami on flaws people implement in their oauth implementations. The talk summary is below "OAuth is one of the most popular authorization frameworks in use today. All major platforms such as Google, Facebook, Box etc support it and you are probably thinking of implementing... Robert A. 2017-05-30T10:40:06-07:00 https://www.cgisecurity.com/2017/05/extensive-ios-hacking-guide-released-by-security-innovation.html Security Innovation has published a very extensive guide to IOS hacking that's worth checking out. Here's the table of contents 1. Setting Up iOS Pentest Lab.................. 5 1.1 Get an iOS Device...................5 1.2 Jailbreaking an iOS Device.................. 7 1.3 Installing Required Software and Utilities .................. 10 2. Acquiring iOS Binaries.................. 13 3.... Development Forensics IndustryNews Robert A. 2017-05-19T09:35:53-07:00