https://hackyjs.com/posts/auditing-a-webauthn-login-flow-for-aitm-proxy-phishing-and-session-token-theft Hacky JS en 2026-09-14T00:00:00.000Z Auditing a WebAuthn Login Flow for AitM Proxy Phishing and Session Token Theft webauthn, passkeys, phishing, authentication, security https://hackyjs.com/posts/hardcoded-keys-in-react-native-bundles-scanning-your-own-artifacts-the-way-claude-scanned-18-million-apks Hacky JS en 2026-09-14T00:00:00.000Z Hardcoded Keys in React Native Bundles: Scanning Your Own Artifacts the Way Claude Scanned 1.8 Million APKs react-native, security, secret-scanning, appsec, mobile https://hackyjs.com/posts/gitlab-cve-2026-85706-patch-order-triage-steps-and-ioc-hunting-for-self-hosted-installs Hacky JS en 2026-09-13T00:00:00.000Z GitLab CVE-2026-85706: Patch Order, Triage Steps, and IoC Hunting for Self-Hosted Installs gitlab, cve-2026-85706, rce, self-hosted, ioc-hunting https://hackyjs.com/posts/why-long-lived-registry-tokens-fail-once-agents-can-publish-packages Hacky JS en 2026-09-13T00:00:00.000Z Why Long-Lived Registry Tokens Fail Once Agents Can Publish Packages supply-chain-security, ai-agents, package-registry, devsecops