In this repo you'll find resources to supplement our session at the SaugaTech Event on June 20th, facilitated by Samiul Islam and Aries Youssefian.
Description: OWASP ZAP (Zed Attack Proxy) is a free, open-source web application security scanner that performs automated security and vulnerability audits. It finds security gaps in web apps and APIs, including SQL Injection, XSS, CSRF, and OWASP Top 10 vulnerabilities.
When to Use:
- Running pre-launch security scans on web applications or APIs
- Testing for common vulnerabilities (injection, XSS, security misconfiguration)
- Scheduling regular automated security audits
- Verifying security fixes after addressing issues
How It Works: ZAP acts as a man-in-the-middle proxy, intercepting traffic between browser and application to scan for vulnerabilities. It supports both automated scanning and manual penetration testing.
Trigger Phrases: "security audit," "vulnerability scan," "run ZAP scan," "check for SQL injection," "web app security test."
Description: Provides structured threat modeling and security audits specifically designed for AI features, agents, and LLM applications. It focuses heavily on the "lethal trifecta" of AI vulnerabilities: untrusted input combined with sensitive data access and external action capabilities.
When to Use:
- Conducting pre-launch security reviews of new AI features
- Expanding existing agents with new tools, actions, or data sources
- Evaluating third-party agents and vendors for safe integration
- Investigating security incidents or analyzing potential tool misuse
- Preparing documentation, talks, or audits regarding AI guardrails and prompt injection risks
Trigger Phrases: "Red team this," "What could go wrong with this agent," "Prompt injection risk," "Lethal trifecta," "Tool misuse," "Jailbreak," "AI security review," "Guardrails check."
Description: A comprehensive code auditing tool that ensures standard software development adheres to strict security best practices and helps identify potential vulnerabilities in your codebase.
When to Use:
- Implementing authentication, authorization, or sensitive payment features
- Handling untrusted user input or file uploads
- Creating new API endpoints or integrating third-party APIs
- Working with secrets, credentials, or environment variables
- Storing or transmitting sensitive data