Offensive360

@offensive360

Enterprise application security: SAST, DAST, MAST, SCA and authorized AI pentesting. Explore deployment options. Book a demo.

Offensive360
@offensive360
Oct 16
A clean DAST result on staging describes staging. Env vars, proxy headers, feature flags and enabled routes differ by environment. Diff them before you accept the report. offensive360.com/platform/?utm_… #DAST #AppSec
Offensive360
@offensive360
Oct 15
Before you turn SAST on for drive-by pull requests, scan main first. Fail the check only on what the diff adds, or the first contributor inherits every old finding. Free tokens for public OSS repos: offensive360.com/free-for-open-… #OpenSource #GitHub
Offensive360
@offensive360
Oct 14
CVE-2026-73031: telegram-search passed message content to v-html unsanitized. Stored XSS that runs for every user who views the message, no click needed. Grep your frontend for v-html today. offensive360.com/zerodays/cve-2… #CVE #AppSec
Offensive360
@offensive360
Oct 13
package.json says ^4.17.0. The build shipped one exact version, and only that one matches an advisory. If your SBOM was built from the manifest, it describes an intent, not an artifact. offensive360.com/software-suppl… #SCA #SBOM
Offensive360
@offensive360
Oct 12
SameSite=Lax cookies still ride top-level GET navigations. A state change behind a GET is still forgeable. Move it to POST, add a session-bound token, validate Origin. Notes on each layer: offensive360.com/knowledge-base… #SecureCoding #CSRF