Field notes from an AI-native security practice

How real startup apps break, how AI surfaces get attacked, and what to fix first.

Latest

Breaking Down Appsec Part 7: That Was Easy (Testing)

Testing and proving that the bugs you found in your code aren’t just theory is how you understand what the word impact really means

Oct 5, 2026Pigeon Labs

$2k in the Bank and Zero Revenue
Pigeon Labs September Investor Update
Oct 4, 2026Pigeon Labs
Breaking Down Appsec Part 6: Let's build a model!
Threat Modeling is often done poorly due to a lack of understanding
Sep 11, 2026Pigeon Labs
Breaking Down Appsec Part 5: You Have no Business Here (Business Logic Flaws)
Appsec is about where everything could go wrong, not just about the latest hacks
Sep 3, 2026Pigeon Labs
Breaking Down Appsec Part 4: Following the Trail (Taint analysis)
Part of appsec and hacking is about understanding how to connect the dots
Aug 28, 2026Pigeon Labs
Breaking Down Appsec Part 3: Securing the Perimeter (Authority/Authorization)
The first steps to secure your application after you know your application is to secure from the outside in
Aug 24, 2026Pigeon Labs
Breaking Down Appsec Part 2: Securing the Perimeter (Identity)
The first steps to secure your application after you know your application is to secure from the outside in
Aug 21, 2026Pigeon Labs
Breaking Down Appsec Part 1: Application Context
Appsec starts from knowing everything
Aug 11, 2026Pigeon Labs
What really is application security (appsec)?
What appsec covers, and why it isn't a compliance checklist
Aug 9, 2026Pigeon Labs
What are we doing?
Doing cyber things like an adult - on our own :') but with the support of our friends who believe in us
Aug 8, 2026Pigeon Labs
I gave my AI agent hands
Give Hermes agent a way to have frictionless deployment with Vals
Apr 23, 2026Pigeon Labs
How to Hack Every AI Agent Ever
The secret sauce to exploiting agents
Mar 29, 2026Pigeon Labs
Three Security Mistakes Almost Every AI Agent Startup Is Making Right Now
I hack AI agents for a living.
Mar 10, 2026Pigeon Labs
I Hack AI Agent Startups With a Bug From 2011
The Vulnerability in Almost Every AI Agent Nobody's Patching
Mar 9, 2026Pigeon Labs
Right Guardrail, Right Place?
Part 4 of the D2 Blog Series: “Authorization in the Age of Agents”
Nov 21, 2025Pigeon Labs
From Guardrails to GuardFails
Part 3 of the D2 Blog Series — “Authorization in the Age of Agents”
Nov 9, 2025Pigeon Labs
From Words to Actions: Why LLMs Need Real Security
From Words to Actions: Why LLMs Need Real Security
Part 2 of the D2 Blog Series — “Authorization in the Age of Agents”
Oct 25, 2025Pigeon Labs
Why Agentic Systems Are Dangerous by Design
Why Agentic Systems Are Dangerous by Design
Part 1 of the D2 Blog Series — “Authorization in the Age of Agents”
Oct 22, 2025Pigeon Labs

Field notes from an AI-native security practice

Breaking Down Appsec Part 7: That Was Easy (Testing)

$2k in the Bank and Zero Revenue

Breaking Down Appsec Part 6: Let's build a model!

Breaking Down Appsec Part 5: You Have no Business Here (Business Logic Flaws)

Breaking Down Appsec Part 4: Following the Trail (Taint analysis)

Breaking Down Appsec Part 3: Securing the Perimeter (Authority/Authorization)

Breaking Down Appsec Part 2: Securing the Perimeter (Identity)

Breaking Down Appsec Part 1: Application Context

What really is application security (appsec)?

What are we doing?

I gave my AI agent hands

How to Hack Every AI Agent Ever

Three Security Mistakes Almost Every AI Agent Startup Is Making Right Now

I Hack AI Agent Startups With a Bug From 2011

Right Guardrail, Right Place?

From Guardrails to GuardFails

From Words to Actions: Why LLMs Need Real Security

Why Agentic Systems Are Dangerous by Design

Don't miss the next one.