All Posts

I recently put together a "Security Arcade" team-building activity for our Netlify staff. The entire project was "vibe coded" in Claude Code using the Vite framework and our Netlify MCP server. I spent maybe half a day on it, which is crazy because if I were to code this from scratch, it would have likely taken me weeks of dedicated time to develop. The game consists of multiple-choice code security questions, focusing on OWASP Top 10 vulnerabilities, in a variety of popular web programming languages. The questions themselves were also generated by Claude Code. The majority of the project was put together in a single prompt describing the type of game I wanted to make and the 1980s arcade feel I wanted it to have. From there, time was spent on refinements and bug fixes. One amusing "bug" was that Claude decided to generate a lot of questions (70% of the bank) where "All of the above" was the correct answer. Much care went into prompting the code editor to ensure the questions, answers, and hints were balanced and accurate. Was it perfect? No. Could it be with more effort? Definitely. Was it perfect for our workshop? Definitely! I received much positive feedback from our staff, and even a request to bring it back for our annual security training! Even though I'm someone who can code in many languages and genuinely loves coding, there's so much power in what you can create quickly using AI tools and some imagination. The future is "building software," not "coding."

I've been tinkering with generating an MCP server to run a SAST analysis on a codebase. It's not more than a "toy" at this stage, but is producing some high fidelity results.

If you want Claude Code to purposefully create code with vulnerabilities in it, you need to ask nicely.

Tune in and join me on June 4th! I'll be joining Red Siege for their "Wednesday Offensive" livestream. Red Siege has been an awesome partner in our security efforts at Netlify. https://lnkd.in/eejGmWxA

Just wrapped up my most important presentation of this week... Career Day at my kids' school! I spoke to really young students, so kept it to explaining how the good guys stop bad guys, and weaved in the topics of offensive security - "good guys acting like bad guys" - and threat intelligence - "good guys spying on bad guys". I also created a cybersecurity matching card game using AI to make it fun.

I'm excited to publish this Threat Intelligence brief!  My team at Netlify was able to uncover an abusive cryptominer campaign which has been targeting the SaaS/PaaS industry since at least 2021.  Activity from wallets associated with this campaign has been observed on the blockchain as recent as today.  Mining activities have centered on cryptocurrencies that favor CPU-based mining algorithms, and specifically this campaign has mined VerusCoin, TideCoin, and Sugarchain cryptocurrencies.  Read on to learn about the behavior and activities of this particular threat.