Char49 will be taking part in OWASP AppSec Days Portugal 2026, one of Portugal’s leading events dedicated to application security, bringing together cybersecurity professionals, developers, researchers, architects, and specialists from across the security community.
One of the challenges for bad actors, apart from finding an exploitable flaw, is to pass unnoticed not only during the research process but also during the exploitation phase. Insufficient logging and monitoring make it hard or even impossible to detect and mitigate suspicious activity or attacks ta...
Introducing breaking changes to a live API with hundreds, thousands, or even millions of active users is (usually) not an option. Releasing a new API version gives a chance to existing users to work on their integrations to migrate to the latest version, without interrupting the service. Nevertheles...
Given their role, APIs interact with several other (software) components such as filesystem, databases, LDAP, or other internal and external APIs. Not all these components are capable of validating and sanitizing the input they receive. When APIs neglect this responsibility, properly validate and sa...
Security Misconfiguration is a broad category in which everything that could have been done to improve the API overall security but that wasn't, fall. Usually, security misconfigurations are a consequence of insecure defaults such as a database without authentication or a permissive Cross- Origin Re...
Fast pace development environments or unclear business or functional requirements make developers choose generic implementations: binding client-provided data (e.g. JSON objects) to data models (e.g. those provided by popular ORM/ODM libraries) is, unfortunately, a common pattern that leaves the doo...
