Editorial Research
Blog
Long-form writing from BugBunny on offensive research, disclosure quality, AI-native security work, and the operating standards behind our public results.
July 18, 2026 • 20 min read
How Two WordPress Core Bugs Chained into Pre-Auth RCE
How REST batch-route confusion, a scalar SQL injection, WordPress's object cache, the Customizer, and a nested REST dispatch formed an unauthenticated path to code execution—and how defenders should respond.
July 13, 2026 • 5 min read
How to Use BugBunny
Our recommended BugBunny workflow: point a fresh scan at an authorized target, provide the original, unsanitized HAR when login context matters, and let the agents work autonomously.
June 30, 2026 • 6 min read
Compliance Automation Software: Automating Evidence Without Automating Assumptions
How compliance automation software should collect evidence, monitor control drift, manage exceptions, and stay connected to security validation.
June 29, 2026 • 6 min read
Secure Software Development Lifecycle: Building Security Into the Work
A practical secure software development lifecycle guide covering requirements, threat modeling, code review, testing, release, and feedback loops.
June 28, 2026 • 6 min read
Open Source Vulnerability Management: Fixing Dependency Risk Without Alert Fatigue
How to manage open-source vulnerabilities using SBOMs, SCA, reachability, ownership, patching, exceptions, and supply-chain validation.
June 27, 2026 • 6 min read
Attack Surface Management Tools: How to Evaluate Discovery, Context, and Validation
How to choose attack surface management tools that find exposed assets, assign owners, prioritize risk, and support validation.
June 26, 2026 • 6 min read
Identity and Access Management Security: The Control Plane Attackers Target
A practical guide to IAM security across users, service accounts, roles, tokens, cloud permissions, reviews, and monitoring.
June 25, 2026 • 6 min read
Continuous Penetration Testing: Keeping Security Testing Close to Change
How continuous penetration testing differs from annual testing and how to use it for APIs, cloud, code, and attack-surface changes.
June 24, 2026 • 6 min read
API Vulnerability Scanner: What to Automate and What to Validate Manually
How to evaluate an API vulnerability scanner for authenticated coverage, schema testing, authorization, abuse cases, and remediation.
June 23, 2026 • 6 min read
Software Supply Chain Security: Protecting the Path From Commit to Production
A practical software supply chain security guide for dependencies, CI/CD, build systems, artifacts, secrets, provenance, and developer tooling.
June 22, 2026 • 6 min read
Cloud Security Posture Management: From Misconfigurations to Attack Paths
How cloud security posture management should prioritize misconfigurations by identity, exposure, data sensitivity, and exploitability.
June 21, 2026 • 6 min read
Automated Vulnerability Scanner: What It Can Find and What It Will Miss
How to use an automated vulnerability scanner for coverage while avoiding false confidence around auth, logic, chained impact, and context.
June 20, 2026 • 6 min read
API Security Best Practices for Production APIs
A production-focused API security checklist covering auth, object access, schemas, rate limits, secrets, logging, and testing.
June 19, 2026 • 6 min read
Cloud Native Security Solution: What to Demand Before You Buy
How to evaluate a cloud native security solution across identity, workloads, Kubernetes, APIs, CI/CD, posture, and runtime validation.
June 18, 2026 • 6 min read
ISO 27001 Compliance: Turning an ISMS Into Working Security Controls
A practical ISO 27001 compliance guide for risk assessment, control selection, evidence, audits, and technical validation.
June 17, 2026 • 6 min read
Best Practices for API Security That Reduce Real Abuse
API security best practices for authentication, authorization, rate limiting, schema validation, logging, and abuse-case testing.
June 16, 2026 • 6 min read
SAST and DAST: How to Combine Static and Dynamic Testing
How SAST and DAST complement each other, what each misses, and how to build a high-signal application security workflow.
June 15, 2026 • 6 min read
Docker Container Security: Hardening Images, Runtime, and Delivery
A practical Docker container security guide for base images, users, secrets, capabilities, registries, CI/CD, and runtime validation.
June 14, 2026 • 6 min read
DevSecOps Automation Tools: What to Put in the Pipeline and What to Keep Out
A practical guide to DevSecOps automation tools for secrets, SAST, SCA, containers, IaC, DAST, API security, and remediation workflows.
June 13, 2026 • 6 min read
Software Audit Compliance: Making Engineering Evidence Audit-Ready
How software audit compliance connects code, dependencies, change management, vulnerability remediation, and control evidence.
June 12, 2026 • 6 min read
Vulnerability Management Best Practices for Fixing What Matters First
Practical vulnerability management best practices for prioritization, ownership, remediation, exceptions, and validation.
June 11, 2026 • 6 min read
What Is Static Code Analysis? A Security-Focused Explanation
What static code analysis does, where it helps, where it fails, and how to use it for high-signal application security.
June 10, 2026 • 6 min read
Security Risk Assessment: How to Turn Unknowns Into Owned Work
A practical security risk assessment workflow for assets, threats, vulnerabilities, controls, impact, likelihood, and remediation.
June 9, 2026 • 6 min read
Autonomous vs Automated Security: What the Difference Means in Practice
A practical comparison of autonomous vs automated security workflows, including review gates, context, control, and accountability.
June 8, 2026 • 6 min read
NIST SP 800-53 Controls: Turning a Large Catalog Into Operational Security
How to work with NIST SP 800-53 controls without losing the connection to systems, owners, evidence, and technical validation.
June 7, 2026 • 6 min read
Audit and Compliance Software: What It Should Prove, Not Just Store
How audit and compliance software should manage controls, evidence, exceptions, policies, owners, and security validation.
June 6, 2026 • 6 min read
Web Application Security: The Controls That Still Matter Most
A practical web application security guide for authentication, authorization, input handling, session safety, headers, logging, and testing.
June 5, 2026 • 6 min read
Continuous Attack Surface Management: What to Watch After the Inventory
How continuous attack surface management helps teams find exposed assets, stale services, shadow APIs, and risky changes.
June 4, 2026 • 6 min read
Vulnerability Management Platforms: How to Choose for Signal, Ownership, and Fix Velocity
How vulnerability management platforms should prioritize findings, assign owners, track remediation, and reduce real exposure.
June 3, 2026 • 6 min read
DAST vs Penetration Testing: What Each Finds and When to Use Both
A clear comparison of DAST and penetration testing for application security programs that need coverage and exploit validation.
June 2, 2026 • 6 min read
NIST Control Families: A Practical Reference for Security Teams
A practical reference to NIST control families and how to turn framework language into testable security controls.
June 1, 2026 • 6 min read
Security Testing for API: A Practical Workflow for Modern Teams
How to run security testing for API endpoints across authentication, authorization, rate limits, input validation, and business logic.
May 31, 2026 • 6 min read
Insecure Direct Object Reference: The Authorization Bug Hiding in Plain Sight
What insecure direct object reference means, how IDOR bugs happen, and how to test object-level authorization before release.
May 30, 2026 • 6 min read
Secure Code Review: How to Find Boundary Failures Before Release
A practical guide to secure code review focused on authentication, authorization, injection, data flow, secrets, and business logic.
May 29, 2026 • 6 min read
DevSecOps Best Practices for Teams That Ship Every Week
A practical DevSecOps best-practices guide covering pull requests, CI/CD, secrets, dependencies, cloud configuration, and feedback loops.
May 28, 2026 • 6 min read
Software Composition Analysis: Beyond Dependency CVE Lists
How software composition analysis helps teams manage open-source dependency, license, supply-chain, and reachability risk.
May 27, 2026 • 6 min read
Database Security Best Practices That Survive Real Incidents
A concise database security checklist for access control, encryption, backups, query exposure, secrets, logging, and incident readiness.
May 26, 2026 • 6 min read
Automating Code Review Without Training Developers to Ignore It
A step-by-step guide to automating code review with high-signal checks, security context, and sane pull-request workflow design.
May 25, 2026 • 6 min read
Container Vulnerability Scanning: Finding the Issues That Actually Ship
How to use container vulnerability scanning to reduce exploitable image, package, secret, and runtime risk without drowning in CVEs.
May 24, 2026 • 6 min read
Automated Code Review: What to Trust, What to Verify, and What to Keep Human
A practical security guide to automated code review for engineering teams that need faster feedback without shallow findings.
May 23, 2026 • 6 min read
Incident Response Automation: Where Speed Helps and Where Humans Still Matter
How to use incident response automation for containment, enrichment, evidence preservation, and repeatable security operations.
May 22, 2026 • 6 min read
Intrusion Detection Systems: What They Catch and Where They Fail
A practical guide to intrusion detection systems, including telemetry quality, detection coverage, false positives, and response handoff.
May 21, 2026 • 6 min read
SOC 2 Compliance Software: A Practical Guide for 2026
How to evaluate SOC 2 compliance software by evidence quality, control ownership, audit readiness, and continuous security validation.
May 20, 2026 • 8 min read
GitHub's VS Code Extension Breach Was a Developer-Device Failure
A technical postmortem on the May 2026 GitHub internal repository breach, poisoned IDE extensions, workspace trust, and how BugBunny helps prevent developer-tooling incidents before they become repository breaches.
March 2026 • 6 min read
Precision Over Volume: Why BugBunny's Signal Stands Out
BugBunny's public record is defined by precision: 89+ CVEs, No. 1 HackerOne Business ranking, and disciplined disclosure that emphasizes relevance over noise.
January 2026 • 12 min read
How We Found 5 Ways to Hack Any Developer Using Google Gemini CLI
Clone a repo. Type gemini. In 3 seconds, an attacker has your AWS keys, GitHub tokens, and everything else in your environment.