
Secure Coding Trainer, Best-selling author of Alice and Bob Learn Secure Coding & Alice and Bob Learn Application Security. #AppSec she/her 🌻
Canada - West Coast 🍁
Joined June 2017
- Tweets61.2K
- Following2.4K
- Followers50.3K
- Likes107K
Tanya Janca | Shehackspurple retweeted
Who is coming to #OpenHack Wednesday next week? Will I see you there? Guess what!?!!?? I'm bringing more books! Yeah that's right, more free cyber books! Come on down.
twp.ai/E5HFty

ALT A cyberpunk-style beaver wearing neon green glasses and a hoodie types on a laptop at a desk, with an “OPEN HACK COWICHAN” sign behind it and a purple mug reading “COFFEE >_ CODE >_ COMMUNITY.” Other visible text includes “SECURE THE ISLAND BUILD THE COMMUNITY” and “BE CURIOUS BE KIND BE HACKY <3.”
Tanya Janca | Shehackspurple retweeted
DevSec Station is back! Tanya on why an AI assistant that's right 59 times still needs checking on the 60th. Required viewing if your devs ship AI-written code.
🚀 **DevSec Station is back for Season 2!**
Your AI worked perfectly 59 times. What about the 60th?
While teaching a secure coding class, I witnessed something rather unexpected.
Nearly 60 students. Same AI assistant. Same programming language. Same prompts.
59 got the expected result.
One got Python code that suppressed linting checks and leaked secrets to an external file.
WHAT?!?!
The AI hadn't escaped. It wasn't even an agent. It was just generating code.
That's why I wanted to start Season 2 with this story.
As we give AI systems access to more tools, files, credentials, and infrastructure, we need to stop designing security around the assumption that they'll always behave as expected.
Season 2 of DevSec Station is about AI, agents, application security, and building systems that can survive being surprised.
🎧 Episode 1: **Your AI Worked 59 Times. What About the 60th?**
Listen or watch here: twp.ai/E5H9v0
#DevSecStation #AppSec #AISecurity #SecureCoding
Tanya Janca | Shehackspurple retweeted
Step one of threat modeling: define the feature. Not “vibes.” Not “the login-ish thing.” Not “you know, that new endpoint.” Name it, understand it, then figure out how it could be misused.
Watch or listen on any podcast platform: twp.ai/E5D9wd
#episode11
Tanya Janca | Shehackspurple retweeted
Developers threat model all the time. You already think about what could break, what weird stuff users might do, and what edge cases could cause chaos. Now we are just adding security to that very useful little habit.
Watch or listen on any podcast platform: twp.ai/E5D9wc
#episode11
Tanya Janca | Shehackspurple retweeted
Always love the work that @shehackspurple produces ! Worth a watch! :D
A malicious npm package was published with **completely valid provenance**.
Wait... WHAT?! 😬
That's what happened in the GHAPPIER software supply chain attack.
And here's the fascinating part:
**The provenance wasn't fake.**
The security control WORKED.
The attackers had gained legitimate access to the source repository and changed the code and publishing workflow.
So the totally legitimate CI/CD system built the malicious code.
The 100% legitimate publishing process published it.
And the provenance very legitimately told us when, where and how that artifact was built.
Because provenance does NOT mean:
"This code is safe."
I made a very short video explaining what happened AND, of course, what developers can do to protect themselves:
🎥 twp.ai/E5FfB0
Tanya Janca | Shehackspurple retweeted
🎟️ Have your ticket yet? Time is running out for BSides Vancouver Island!
Join the island's cybersecurity community for a day packed with insightful talks, great networking, hands-on learning, and an incredible lineup of security professionals.
#BSidesVI2026 #CyberSecurity
Tanya Janca | Shehackspurple retweeted
Threat modeling sounds fancy until you realize it mostly means asking: “How could this thing go sideways?”
No crystal ball. No dramatic chanting. Just practical thinking before the security gremlins move in.
Watch or listen on any podcast platform: twp.ai/E5D9wS
#episode11
Tanya Janca | Shehackspurple retweeted
🎟️ Get Your Tickets! 🎟️
Time is running out to join the Vancouver Island cybersecurity community at BSides Vancouver Island!
Secure your spot before tickets are gone:
👉 bsidesvi.com
#BSidesVI2026 #CyberSecurity #InfoSec
Tanya Janca | Shehackspurple retweeted
Exactly this. We know how to make walls that these things can't get around. We just don't because security isn't prized. What isn't discussed about the HF hack is that it was a known vulnerability that a non-AI hacker would have found if they went looking.
Does it *actually* matter if the thing attacking your application is an AI agent?
I don't think so.
Human attacker? Script? Bot? AI agent?
Your application still needs to withstand hostile behaviour.
Correct authentication and authorization. Least privilege. Input validation. Rate limits. Logging. Monitoring. Alerting.
The big difference with agents is **speed and adaptability**.
They can potentially discover something, try it, adapt, try something else, exploit a vulnerability, and keep moving.
They also don't need sleep, snacks, or bathroom breaks. :-/
So perhaps we don't need a whole new magical category of "AI agent security."
But we do need to get really, really good at AppSec.
🎥 I talked about it here: twp.ai/E5FNo7
Tanya Janca | Shehackspurple retweeted
AI “Safety” people make a lot of noise. Because they have shares in AI labs.
If you want the opinion of a real cybersecurity expert, this is it below. To avoid getting hacked you actually have to know about security. AI “Safety” people do not.
Does it *actually* matter if the thing attacking your application is an AI agent?
I don't think so.
Human attacker? Script? Bot? AI agent?
Your application still needs to withstand hostile behaviour.
Correct authentication and authorization. Least privilege. Input validation. Rate limits. Logging. Monitoring. Alerting.
The big difference with agents is **speed and adaptability**.
They can potentially discover something, try it, adapt, try something else, exploit a vulnerability, and keep moving.
They also don't need sleep, snacks, or bathroom breaks. :-/
So perhaps we don't need a whole new magical category of "AI agent security."
But we do need to get really, really good at AppSec.
🎥 I talked about it here: twp.ai/E5FNo7
Tanya Janca | Shehackspurple retweeted
🎉 25 years of OWASP. Let’s make the community even bigger!
We’re celebrating 25 years of OWASP by giving you a reason to bring someone new into the community. 💛
🎁 Join OWASP in the next 25 days and get 1 FREE year's individual membership to gift to a friend!
Your membership comes with benefits, including:
🎟️ Discounted conference fees
🎓 Priority access to grants, awards & scholarships
🗳️ A vote in OWASP elections
📧 A complimentary @owasp.org email
💻 Access to the OWASP learning platform
🤝 Partner discounts & benefits
❤️ And the chance to support OWASP's mission
One membership. Twice the impact.
⏰ 25 days. Who are you bringing with you?
👉 Become a member: bit.ly/OWASPBringaFriend
This offer is for new memberships only. Redeemable codes will be sent via email within a week of completing membership sign-up and payment. Offer ends on September 30th 2026.
#appsec #opensource #community #bogo #bringafriend
Tanya Janca | Shehackspurple retweeted
🚨 CFP CLOSES TUESDAY.
First talk or fiftieth — this is your sign.
⚡ Frontier AI
🇨🇦 Digital Sovereignty
🛡️ Cyber Resilience
🎤 Open Stage
No gatekeepers. No pay-to-play. No vendor pitches.
⏰ Sept 15 • 23:59 EDT
👉 bsidesottawa.ca/cfp
#BSidesOttawa
Tanya Janca | Shehackspurple retweeted
If you are in cybersecurity be sure to signup for the CVP program of a frontier model and try doing security code review with it yourself. Especially old projects.
The ability is dramatic improvement over *AST tools. Check it out for yourself! 🤙
Tanya Janca | Shehackspurple retweeted
🔥 To celebrate our 5th year of conference, we are going to make this year EPIC with TWO TALK TRACKS, a Quantum Village, a lock-picking village and all the networking you can handle! 🔥
Get your tickets today! bsidesvi.com/
Tanya Janca | Shehackspurple retweeted
Happy Friday, cyber enthusiasts!
The cat's out of the bag, thanks to Quantum Village for announcing that they will be with us Friday, September 25, 2026 for BSides Vancouver Island!
#BSidesVI2026 #cybersecurity #infosec
Tanya Janca | Shehackspurple retweeted
In this short video Tanya gives her #1 best tip for securing APIs!
twp.ai/E5EHWy
Tanya Janca | Shehackspurple retweeted
In this short, funny video Tanya explains why our APIs should not provide verbose error messages, which is a lesson from Chapter 5 of Alice and Bob Learn Secure Coding.
twp.ai/E5EHUG
Tanya Janca | Shehackspurple retweeted
Is AI-generated code secure?
Yes. No. Sometimes. 😁
In fact, AI-generated code tends to be less secure than human-written code right now.
That doesn't mean "don't use AI." It means we need to understand what we're getting ourselves into.
Watch the video. 👇
twp.ai/E5EHTc
Tanya Janca | Shehackspurple retweeted
Join us for #OpenHack Cowichan Valley Sept 16th, at the Craig Street in Duncan, BC!
twp.ai/E5Ea7P





















