Security research, tutorials, and updates from the HackerSavanna team.
Why raw CVSS is the wrong sort key, a working EPSS-weighted priority formula with a defensible asset criticality score, dependency and container scanning code, an SLA framework, and what a leadership report should actually contain.
A system prompt is not a security boundary. The full OWASP LLM Top 10, real public incidents, indirect injection and insecure output handling with code, CVSS scoring guidance for AI findings, and the live-tested fix that actually held up.
A High-severity authentication bypass on HackerSavanna's own platform, found and responsibly disclosed by researcher Sylvester Jusu, just earned him premium access to the AfricaHackon Dojo, courtesy of Cyber Guard Africa and AfricaHackon.
A Critical Firestore security misconfiguration, responsibly disclosed and fully fixed, just earned HackerSavanna researcher Sylvester Jusu a fully funded scholarship to AfricaHackon Academy Cohort 7, courtesy of Cyber Guard Africa and AfricaHackon.
Why a jailbroken chatbot is a PR problem but a jailbroken agent is a security incident, and how to test the tool-calling boundary that actually matters.
Direct and indirect prompt injection explained through realistic, tool-calling attack chains, plus a concrete methodology for testing AI features in scope.
Get new posts delivered straight to your inbox. No spam - unsubscribe any time.