# Pigeon Labs

> Pigeon Labs is a NYC cybersecurity services company specializing in penetration testing and application security for AI agents. We publish Breaking Down Appsec, a free series on doing application security without a dedicated security team.

Contact: hello@pigeonlabs.ai

## Breaking Down Appsec (free series)
- [Breaking Down Appsec Part 1: Application Context](https://pigeonlabs.ai/blog/breaking-down-appsec-part-1-application-context): Appsec starts from knowing everything
- [Breaking Down Appsec Part 2: Securing the Perimeter (Identity)](https://pigeonlabs.ai/blog/breaking-down-appsec-part-2-securing-the-perimeter-identity): The first steps to secure your application after you know your application is to secure from the outside in
- [Breaking Down Appsec Part 3: Securing the Perimeter (Authority/Authorization)](https://pigeonlabs.ai/blog/breaking-down-appsec-part-3-securing-the-perimeter-authority-authorization): The first steps to secure your application after you know your application is to secure from the outside in
- [Breaking Down Appsec Part 4: Following the Trail (Taint analysis)](https://pigeonlabs.ai/blog/breaking-down-appsec-part-4-following-the-trail-taint-analysis): Part of appsec and hacking is about understanding how to connect the dots
- [Breaking Down Appsec Part 5: You Have no Business Here (Business Logic Flaws)](https://pigeonlabs.ai/blog/breaking-down-appsec-part-5-you-have-no-business-here-business-logic-flaws): Appsec is about where everything could go wrong, not just about the latest hacks
- [Breaking Down Appsec Part 6: Let's build a model!](https://pigeonlabs.ai/blog/breaking-down-appsec-part-6-lets-build-a-model): Threat Modeling is often done poorly due to a lack of understanding
- [Breaking Down Appsec Part 7: That Was Easy (Testing)](https://pigeonlabs.ai/blog/breaking-down-appsec-part-7-that-was-easy-testing): Testing and proving that the bugs you found in your code aren’t just theory is how you understand what the word impact really means

## Other posts
- [$2k in the Bank and Zero Revenue](https://pigeonlabs.ai/blog/2k-in-the-bank-and-zero-revenue): Pigeon Labs September Investor Update
- [What really is application security (appsec)?](https://pigeonlabs.ai/blog/what-really-is-application-security-appsec): What appsec covers, and why it isn't a compliance checklist
- [What are we doing?](https://pigeonlabs.ai/blog/where-have-i-been): Doing cyber things like an adult - on our own :') but with the support of our friends who believe in us
- [I gave my AI agent hands](https://pigeonlabs.ai/blog/i-gave-my-ai-agent-hands): Give Hermes agent a way to have frictionless deployment with Vals
- [How to Hack Every AI Agent Ever](https://pigeonlabs.ai/blog/how-to-hack-every-ai-agent-ever): The secret sauce to exploiting agents
- [Three Security Mistakes Almost Every AI Agent Startup Is Making Right Now](https://pigeonlabs.ai/blog/three-security-mistakes-almost-every-ai-agent-startup-is-making-right-now): I hack AI agents for a living.
- [I Hack AI Agent Startups With a Bug From 2011](https://pigeonlabs.ai/blog/i-hack-ai-agent-startups-with-a-bug-from-2011): The Vulnerability in Almost Every AI Agent Nobody's Patching
- [Right Guardrail, Right Place?](https://pigeonlabs.ai/blog/right-guardrail-right-place): Part 4 of the D2 Blog Series: “Authorization in the Age of Agents”
- [From Guardrails to GuardFails](https://pigeonlabs.ai/blog/from-guardrails-to-guardfails): Part 3 of the D2 Blog Series — “Authorization in the Age of Agents”
- [From Words to Actions: Why LLMs Need Real Security](https://pigeonlabs.ai/blog/from-words-to-actions-why-llms-need-real-security): Part 2 of the D2 Blog Series — “Authorization in the Age of Agents”
- [Why Agentic Systems Are Dangerous by Design](https://pigeonlabs.ai/blog/why-agentic-systems-are-dangerous-by-design): Part 1 of the D2 Blog Series — “Authorization in the Age of Agents”