We review the OWASP top ten API list from the perspective of gRPC. Here's how the API vulnerabilities arise in gRPC and ways to respond.
Server Side Request Forgery | OWASP Foundation
Server Side Request Forgery on the main website for The OWASP Foundation. OWASP is a nonprofit foundation that works to improve the security of software.
An inside look at gRPC - performance, testing and load balancing, Mon, Jul 22, 2024, 6:00 PM | Meetup
Agenda: 5:30 Doors open 6:00 - 6:05: Announcements 6:05 - 6:30: The rest of the iceberg: performance and testing of the gRPC libraries - Ashley Zhang and AJ Heller 6:30 - 7
gRPC | Google Open Source
gRPC is a modern RPC framework that can run in any environment. It can efficiently connect services in and across data centers with pluggable support for load balancing, tracing, health checking and authentication. It is also applicable in last mile of distributed computing to connect devices, mobile applications and browsers to backend services.
Building AIP: An ATProtocol Authorization Gateway - Nick's Blog
OAuth is the first challenge developers face in the atmosphere. This post is about AIP, the authorization gateway we built at Graze Social to alleviate some of the pain.
grpc/doc/health-checking.md at master · grpc/grpc
C++ based gRPC (C++, Python, Ruby, Objective-C, PHP, C#) - grpc/grpc
API Overview | OpenAlex technical documentation
The API is the primary way to get OpenAlex data. It's free and requires no authentication. The daily limit for API calls is 100,000 requests per user per day. For best performance, add your email to all API requests, like [email protected].
Defeating Prompt Injections by Design
Large Language Models (LLMs) are increasingly deployed in agentic systems that interact with an untrusted environment. However, LLM agents are vulnerable to prompt injection attacks when handling untrusted data. In this paper we propose CaMeL, a robust defense that creates a protective system layer around the LLM, securing it even when underlying models are susceptible to attacks. To operate, CaMeL explicitly extracts the control and data flows from the (trusted) query; therefore, the untrusted data retrieved by the LLM can never impact the program flow. To further improve security, CaMeL uses a notion of a capability to prevent the exfiltration of private data over unauthorized data flows by enforcing security policies when tools are called. We demonstrate effectiveness of CaMeL by solving $77\%$ of tasks with provable security (compared to $84\%$ with an undefended system) in AgentDojo. We release CaMeL at https://github.com/google-research/camel-prompt-injection.
bradleyjkemp/grpc-tools
A suite of gRPC debugging tools. Like Fiddler/Charles but for gRPC.
Backend infrastructure - Tinfoil Documentation
This page provides a description of the different components that make up our backend infrastructure. It also describes how Tinfoil guarantees code auditability and data confidentiality using these components.
ngerakines/atproto-tools - Docker Image
A comprehensive collection of Rust components for creating AT Protocol applications. This workspace provides essential building blocks for identity management, record operations, OAuth 2.0 authentication flows, HTTP client operations, XRPC services, and real-time event streaming.
Socket - Block zero-day supply chain attacks
Socket fights vulnerabilities and provides visibility, defense-in-depth, and proactive supply chain protection for JavaScript, Python, and Go dependen...
OWASP GenAI Security Project Releases Top 10 Risks and Mitigations for Agentic AI Security
Culmination of over 100 industry leaders’ input and extensive published resources to deliver critical guidance to address Agentic AI Security risks WILMINGTON, Del. — Dec. 10, 2025 — The OWASP GenAI Security Project (genai.owasp.org), a leading global open-source and expert community dedicated to delivering practical guidance and tools for securing generative and agentic AI, […]
AppView API · co/core
Read-only XRPC queries over the co/core AppView index — receipts, jobs, providers, and social graph state.
gRPC: 5 Years Later, Is It Still Worth It?
5 years with gRPC: Is it still my go-to for communication? Dive into my journey and discover if this protocol stands the test of time.
Investigation into Message Layer Security (MLS)
This article investigates Message Layer Security (MLS), the IETF standard protocol (RFC 9420) for Signal-style end-to-end encryption. Through a practical analysis of OpenMLS (the Rust reference implementation) and a demonstration CLI chat application (mls-chat), the post reveals the substantial gap between protocol specification and production deployment. Introduction MLS (Message Layer …
Developer Ecosystems for Software Safety
How to design and implement information systems so they are safe and secure is a complex topic. Both high-level design principles and implementation guidance for software safety and security are well established and broadly accepted. For example, Jerome Saltzer and Michael Schroeder’s seminal overview of principles of secure design was published almost 50 years ago,10 and various community and governmental bodies have published comprehensive best practices about how to avoid common software weaknesses—for example, Common Weakness Enumeration (CWE)a and Open Worldwide Application Security Project (OWASP) Cheat Sheet Series.b
