Web vulnerabilities, one class at a time
Most serious findings in a web app fall into a few classes: broken access control such as IDOR, weak transport security, components with known CVEs and, in apps built on language models, prompt injection and excessive agency.
Each article here takes one class, shows it on code you can run yourself or on CyberGym, and ends with the fix. For a short definition of a term first, see the Learn glossary.
AppMap lists every API endpoint of your app with the auth it requires, the starting point for finding broken access control.
Articles
IDOR vulnerability example: find it and fix it
What an IDOR is, shown on the real basket handler of CyberGym, a deliberately vulnerable training app, then reproduced and fixed in a small local Express app with two users.
Web security tools: check your TLS, look up CVEs and log what a page requests
How HackerGPT checks a site's TLS configuration with sslscan, looks up a CVE in the public databases, and logs the API calls a page makes in a real browser. Includes real output from CyberGym.
Threat modeling AI agents with the OWASP LLM and Agentic Top 10
Map your AI agent onto the 2026 OWASP Top 10 for LLM Applications and the Agentic Top 10, then test it for prompt injection with a canary. Real results from a local run.