Anvil Secure

Security Engineer Matteo Giordano introduces Passkey Editor, a Burp Suite extension that decodes and edits WebAuthn ceremonies, drives one-click attacks against them, and re-signs across eleven COSE algorithms, all inside Burp itself. The post Passkey Edi

Anvil Secure's internal AI adoption hackathon gave engineers dedicated time to explore practical AI use cases. Technical Director Antonios Papadopoulos shares what the team learned and what comes next. The post Internal AI Adoption Hackathon: What We Lear

Director of Research Tao Sauvage shares the latest chapter in his SAP research, chasing a bug from SAP's archive tool into CommonCryptoLib, a flaw reachable before authentication on SAP HANA. He breaks down the root cause and his attempts to exploit it. T

CTO Vincent Berg mirrored more than 180,000 Ruby gems and built a scanner to analyse them at scale. What he uncovered offers a fascinating look at the hidden risks and exposed data scattered throughout the Ruby ecosystem. The post Finding Crown Jewels: Hu

Director of Research Tao Sauvage breaks down how Anvil uses LLMs during secure code review, keeping human judgment at the center. He compares two approaches across three open-source targets to show why a structured workflow catches more vulnerabilities. T

From threat modeling and attack surface mapping to jailbreaks and prompt injection, Security Engineer George Damiris walks through how Anvil Secure tests LLM and GenAI systems for security vulnerabilities. The post How We Test AI: LLM & GenAI Security Met

In Part 2 of a three-part series, Security Engineer Matteo Giordano explores passkey architecture, covering origin binding, synced vs. device-bound credentials, authenticator types, and deployment quirks like key wrapping and signature counters. The post

In Part 1 of a new series, security engineer Matteo Giordano walks through the mechanics behind passkeys, from the FIDO2 protocol stack to the raw data structures exchanged during registration and authentication. The post Demystifying Passkeys - Under the

Senior Security Engineer Riccardo Nannini introduces OffTempo, a Burp Suite extension designed to identify timing-based information leaks by comparing request patterns and analysing subtle differences in response times. The post Introducing OffTempo, Stat

Dana Hehl, Chief Operations Officer at Anvil Secure, reflects on what happens to vulnerability management programs when AI-driven discovery outpaces the processes built to triage and act on findings. The post What Breaks When Vulnerability Discovery Speed