Journal
Notes from the security bench.
Field notes and essays from the team that builds Nyxeara. The same evidence-based standard we apply to our findings, applied to what we write.
Foundations2026-09-01· 9 min
What is DAST? Dynamic application security testing, explained in plain terms
A sober explanation of dynamic application security testing — what it measures, what it does not, and where it fits in a mature security program.
ReadFoundations2026-08-20· 11 min
Web application security: attacks you cannot ignore and how to test for them
The core of web application security — the attack classes that matter, why they persist, and how dynamic testing keeps them out of production.
ReadDiscovery2026-08-05· 8 min
Shadow API discovery: finding the endpoints your inventory never saw
Undocumented APIs are a back door you cannot secure because you do not know they exist. Here is how to discover them — and why it is the first act of testing.
ReadPractice2026-07-15· 7 min
Why false positives are a design failure, not an inevitability
Triage consumes more engineering time than scanning ever will. The fix is not better filtering — it is verification inside the tool.
Read