Application Security · Vulnerability Research · Security Tooling
Practical research on how software breaks—and how to build it safer.
By Paolo Perego, Product Security Engineer and open-source security tooling builder.
Featured
AI will automate a significant part of Product Security work, but it will not eliminate the need for security engineers. The real shift is from scanner-driven vulnerability management toward architecture, exploitability, mitigation design, secure tooling, and engineering guardrails.
Read insightRecent writing
NGINX Rift and PoolSlip expose dangerous memory corruption flaws inside one of the Internet’s most trusted reverse proxies, turning rewrite rules into a potential...
Read insightSignal Engine 0.3.0 transforms raw security findings into structured, actionable insight. With clustering, deduplication, and risk-based hotspots, noise gives way to clarity. Less data...
Read insightSoak is a zero-dependency Docker image that aggregates a curated set of open-source security scanners into a single, reproducible execution environment.
Read insightTurning security tool outputs into actionable insights is one of the biggest challenges for developers and security engineers. In this post, I’m sharing a...
Read insightIn the previous post, we saw how many security tools can “lie”: they don’t tell the full story, generate noise, and often leave teams...
Read insightWe live in a world where developers and security teams are drowning in alerts. Every scanner, every automated tool, every “security dashboard” promises to...
Read insightEditorial focus
Deep analysis of vulnerabilities, exploitability and real attack surfaces.
Explore this areaCode review, threat modeling, secure design and practical engineering guardrails.
Explore this areaOpen-source tools that reduce noise and turn findings into actionable signal.
Explore this areaOpen source
Python · security findings analysis
Normalizes, deduplicates, clusters, and scores findings from multiple security tools to surface actionable risk.
Source-code security scanner
A source-code analysis tool whose results can be ingested and normalized by Signal Engine.
Python · web application testing
A mitmproxy-based research tool for scoped crawling, passive analysis, and focused active security checks.
Ruby · static analysis
A source-code security scanner for Ruby web applications, with checks for vulnerable dependencies and unsafe code patterns.
About the author
Paolo Perego works at the intersection of software engineering and security. He reviews code, researches vulnerabilities and builds open-source tools that help engineering teams separate meaningful risk from security noise.