--- title: "AppSec" canonical_url: https://www.janbrennenstuhl.eu/topics/application-security/ author: Jan Brennenstuhl --- # AppSec Secure defaults, platform-level controls and the attacks they have to hold against, from phishing to supply chains. Application security works best as defaults built into platforms, not as findings handed back to teams. This hub collects the operating-model essays alongside notes on phishing, honeytokens and supply-chain hygiene. ## Entries - [AppSec in the Age of Agentic Engineering](https://www.janbrennenstuhl.eu/talks/htw-berlin-agentic-appsec/) (2026-07-03, talk): AppSec teams should shape the harness, platform and risk model that coding agents work inside, because finding problems after the code is written cannot keep up with agents. Markdown: https://www.janbrennenstuhl.eu/talks/htw-berlin-agentic-appsec/index.md - [Guest Lecture at HTW Berlin: AppSec in the Age of Agentic Engineering](https://www.janbrennenstuhl.eu/new-appsec-operating-model/) (2026-07-03, essay): AppSec teams should shape the harness, platform and risk model that coding agents work inside, because finding problems after the code is written cannot keep up with agents. Markdown: https://www.janbrennenstuhl.eu/new-appsec-operating-model/index.md - [Shift Down: Why Agentic Engineering Demands Platform-Level Security](https://www.janbrennenstuhl.eu/shift-down-appsec/) (2026-06-14, essay): Coding agents multiply whatever patterns exist, so AppSec should build security into platform defaults that remove risky decisions, and keep scanning as the fallback. Markdown: https://www.janbrennenstuhl.eu/shift-down-appsec/index.md - [Dependency Updates: latest Is Not a Security Strategy](https://www.janbrennenstuhl.eu/dependency-updates/) (2026-05-15, essay): Automatic dependency updates push compromised packages into builds within hours, so teams should pin exact versions, enforce release-age cooldowns, and upgrade on their own schedule after review. Markdown: https://www.janbrennenstuhl.eu/dependency-updates/index.md - [AppSec in the Age of Agentic Engineering](https://www.janbrennenstuhl.eu/appsec-agentic-engineering/) (2026-05-14, essay): AppSec teams keep up with coding agents by fixing findings inside the agent loop, shipping security tooling to agents, and managing risk budgets together with SRE and platform teams. Markdown: https://www.janbrennenstuhl.eu/appsec-agentic-engineering/index.md - [Bunny Shield Review: 3 Things Need Improvement](https://www.janbrennenstuhl.eu/bunny-shield-review/) (2025-06-07, essay): Bunny Shield is easy to set up and has reasonable default rules, but it needs bot allowlisting, traceable WAF event logs and a fix for blocked Let's Encrypt HTTP-01 challenges. Markdown: https://www.janbrennenstuhl.eu/bunny-shield-review/index.md - [What is Whaling Cyber Awareness? Prevention Tips & Training](https://www.janbrennenstuhl.eu/whaling-awareness/) (2023-05-23, essay): Whaling defense combines regular awareness training and simulations with SPF, DKIM and DMARC, two-factor email login, and payment policies that require out-of-band verification and two sign-offs. Markdown: https://www.janbrennenstuhl.eu/whaling-awareness/index.md - [Whaling Phishing: Definition and Prevention Strategies](https://www.janbrennenstuhl.eu/whaling-phishing/) (2023-05-18, essay): Whaling targets executives with researched, personalized phishing that technical controls alone do not stop, so organizations need awareness training and must verify unusual payment requests through a separate channel. Markdown: https://www.janbrennenstuhl.eu/whaling-phishing/index.md - [Step-Up Authentication: Elevating Security with OpenID Connect (OIDC)](https://www.janbrennenstuhl.eu/step-up-authentication/) (2023-05-14, essay): Step-up authentication asks for extra factors only for sensitive actions, and OpenID Connect relying parties can request it from the identity provider with the max_age and acr_values parameters. Markdown: https://www.janbrennenstuhl.eu/step-up-authentication/index.md - [Password Attack Guide: What is Password Spraying?](https://www.janbrennenstuhl.eu/password-spraying/) (2023-05-11, essay): Password spraying tries a few common passwords across many accounts to avoid lockouts, so defenders need failed-login monitoring, bot management and MFA, and passwordless login removes the target entirely. Markdown: https://www.janbrennenstuhl.eu/password-spraying/index.md - [Honeytoken: Authentication Attack Breach Detection](https://www.janbrennenstuhl.eu/honeytoken/) (2023-04-29, essay): Fake customer accounts with plausible credentials, planted in the user database and watched by the identity provider, alert a security team when attackers use breached data, though they cannot prevent attacks. Markdown: https://www.janbrennenstuhl.eu/honeytoken/index.md - [How do you protect accounts from stolen credentials?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/) (2023-04-21, guide): Checking credentials against breach data and adding device and location risk signals to the login decision reduce the risk from stolen passwords. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/credential-stuffing/index.md - [How do attackers take over accounts?](https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/) (2023-04-21, guide): At least 35 of 75 popular online services studied were vulnerable to account pre-hijacking attacks. Markdown: https://www.janbrennenstuhl.eu/knowledge-base/account-security/account-takeover/index.md - [About Jan Brennenstuhl](https://www.janbrennenstuhl.eu/about/) (2021-04-08, profile): Jan Brennenstuhl is a principal engineer focused on application security, agentic engineering, and the intersection of security, usability, and automation. Markdown: https://www.janbrennenstuhl.eu/about/index.md - [Weak Crypto, Github SAML Attack & Twitter Security UX](https://www.janbrennenstuhl.eu/weak-google-crypto-github-saml/) (2017-01-15, essay): GitHub Enterprise users should patch a critical SAML authentication bypass right away, and Twitter's login alert email shows how a badly worded security notification can work against users. Markdown: https://www.janbrennenstuhl.eu/weak-google-crypto-github-saml/index.md