Application Security · Vulnerability Research · Security Tooling
Practical research on how software breaks—and how to build it safer.
By Paolo Perego, Product Security Engineer and open-source security tooling builder.
Featured
OWASP Orizon started in 2006 with ASTs, program models, call graphs and data flow. Dawnscanner took a more pragmatic path. Twenty years later, DRSource is bringing me back to the same question: how much of a program must an analysis engine understand to become...
Read insightRecent writing
AI will automate a significant part of Product Security work, but it will not eliminate the need for security engineers. The real shift is...
Read insightNGINX Rift and PoolSlip expose dangerous memory corruption flaws inside one of the Internet’s most trusted reverse proxies, turning rewrite rules into a potential...
Read insightSignal Engine 0.3.0 transforms raw security findings into structured, actionable insight. With clustering, deduplication, and risk-based hotspots, noise gives way to clarity. Less data...
Read insightSoak is a zero-dependency Docker image that aggregates a curated set of open-source security scanners into a single, reproducible execution environment.
Read insightTurning security tool outputs into actionable insights is one of the biggest challenges for developers and security engineers. In this post, I’m sharing a...
Read insightIn the previous post, we saw how many security tools can “lie”: they don’t tell the full story, generate noise, and often leave teams...
Read insightEditorial focus
Deep analysis of vulnerabilities, exploitability and real attack surfaces.
Explore this areaCode review, threat modeling, secure design and practical engineering guardrails.
Explore this areaOpen-source tools that reduce noise and turn findings into actionable signal.
Explore this areaOpen source
Python · security findings analysis
Normalizes, deduplicates, clusters, and scores findings from multiple security tools to surface actionable risk.
Source-code security scanner
An open-source security code review engine exploring cross-file data flow, program modelling and explainable attack paths.
Python · web application testing
A mitmproxy-based research tool for scoped crawling, passive analysis, and focused active security checks.
Ruby · static analysis
A source-code security scanner for Ruby web applications, with checks for vulnerable dependencies and unsafe code patterns.
About the author
Paolo Perego works at the intersection of software engineering and security. He reviews code, researches vulnerabilities and builds open-source tools that help engineering teams separate meaningful risk from security noise.