Brian Vermeer
where else to find them
what they talk about
all 9 in the filters
where they keep going back
- Devoxx Belgium3 editions2017–2024
- Jfokus3 editions2019–2025
- Voxxed Days Bucharest2 editions2024–2026
all 30 in the filters
on a stage with
all 40 in the filters
who talks about the same things
- Simon Maple18 talks
- Steve Poole41 talks
- Julien Topçu52 talks
- Maurice Naftalin30 talks
- Victor Rentea45 talks
- Piotr Przybył41 talks
| title | conference | date |
|---|---|---|
| Breaching LLM-Powered Apps: Overcoming Security and Privacy Challenges | Voxxed Days Bucharest 2026 | 2026-04-28 |
Live demo overwrites the app’s terms of use via a path traversal upload and RAG poisoning to add an exception that triggers a $100 credit and cancels booking… | ||
| Understanding Prompt Injection - Techniques, Challenges, and Advanced Escalation | Devoxx France 2026 | 2026-04-22 |
Live demos show a Quarkus test agent (Rogerbot with web_fetch and env) that leaks its system prompt and fake API keys via payload splitting and multi-turn… | ||
| The Hidden Security Hazards in Your Java Stack | Devoxx France 2026 | 2026-04-22 |
Shows concrete failures and fixes: Copilot produces a concatenated query that becomes SQL injection via Copilot-generated query; Burp Suite intercepts uploads… | ||
| Don't Get Burned! Secure Coding Essentials to Protect Your Application | JCON EUROPE 2026 | 2026-04-20 |
A demo Spring Boot app shows real exploits that work: SQL injection: concatenated query allows an attacker to run "UPDATE products SET price=0" and zero out… | ||
| Breaching LLM-Powered Applications: Overcoming Security and Privacy Challenges | Spring I/O 2026 | 2026-04-13 |
Shows concrete attacks and fixes: a Spring Boot + LangChain rental app gets RAG poisoning when an uploaded file overwrites terms of use via path traversal via… | ||
| The Hidden Security Hazards in Your Java Stack | Voxxed Days Zurich 2026 | 2026-03-24 |
Cloud‑native Java workflows produce concrete risks: an AI assistant (Copilot) outputs code that enables SQL injection via concatenated queries, Burp Suite… | ||
| Breaching LLM-Powered Applications: Overcoming Security and Privacy Challenges | DevFest Paris 2025 | 2025-11-21 |
Shows live exploits against a Spring Boot + LangChain forj demo using Burp Suite, OpenAI (GPT‑3.5, GPT‑4 mini) and local Llama 3.1: a path traversal overwrite… | ||
| Breaking AI: Live coding and hacking applications with Generative AI | DevFest Nantes 2025 | 2025-10-16 |
Live code builds a Spring Boot coffee-shop app with GitHub Copilot and ChatGPT, then deliberately weaponizes the generated output: Copilot produces a raw SQL… | ||
| Securing LLM-Powered Applications: Overcoming Security and Privacy Challenges | Porto Tech Hub Conference 2025 | 2025-10-07 |
Demo shows a rental app and a shopping assistant where uploaded terms and a crafted file overwrite canonical docs, then a vroom vroom trigger plus RAG… | ||
| Inside the Porto Tech Hub Conference 2025: Interview | Porto Tech Hub Conference 2025 | 2025-10-07 |
Second visit reports a packed venue of 1,600 people and a room full for an early security session that unexpectedly drew sustained Q A, prompting followups for… | ||
| Don't Get Burned! Secure Coding Essentials in Java to protect your application. | DevBcn 2025 | 2025-07-08 |
Live demos show SQL injection via string concatenation (copilot-generated search code lets an attacker run "update product set price=0"), file upload path… | ||
| Securing LLM Applications: Overcoming Security & Privacy Challenges | JCON EUROPE 2025 | 2025-05-12 |
Demonstrates concrete attacks and fixes: attackers use Burp Suite and path traversal to upload a modified terms document that injects a secret word vroom… | ||
| Securing LLM-Powered Apps: Overcoming Security and Privacy Challenges | Voxxed Days Zürich 2025 | 2025-03-25 |
Live demos show concrete breakage: a path traversal file overwrite poisons the RAG corpus to cancel a Tesla booking, a SQL injection injects fake chat memory… | ||
| Securing LLM-Powered Applications: Overcoming Security and Privacy Challenges | Jfokus 2025 | 2025-02-03 |
Shows concrete exploits and fixes: a live demo where a malicious chat entry becomes part of RAG or chat memory and causes an LLM to cancel a booking, a Burp… | ||
| Don't Get Burned: Secure Coding Essentials in Java to protect your application | Voxxed Days CERN 2025 | 2025-01-15 |
Live demos show a Spring Boot app vulnerable to SQL injection via JPA createNativeQuery (fixed by prepared/parameterized statements), a file upload exploited… | ||
| Securing LLM-Powered Applications: Overcoming Security and Privacy Challenges | Devoxx Belgium 2024 | 2024-10-07 |
Shows concrete attacks and defenses: a Spring Boot app using LangChain for J and a GPT-3.5 / Llama 3.1 stack lets an attacker upload a crafted file to… | ||
| Brian Vermeer at JNation 2024 | JNation 2024 | 2024-06-04 |
Overview covers code constructions that go terribly wrong, from obvious SQL injection to subtle Java pitfalls, and recommends catching flaws during development… | ||
| Securing Your Java Containers by Breaking In | Voxxed Days Bucharest 2024 | 2024-03-27 |
Shows live breakins: ImageMagick in a base image allows RCE via crafted images, Apache Struts + Tomcat 8.5.2 yields an uploaded JSP webshell, Spring Data REST… | ||
| Mastering the AI Shift: Adaptive Strategies for Software Evolution | Voxxed Days Bucharest 2024 | 2024-03-27 |
Panel reports real-world use of Co-pilot and ChatGPT for coding, email triage and market research, with seniors gaining efficiency while junior PR-quality… | ||
| Don't Get Burned! Secure Coding Essentials to Protect Your Application | IntelliJ IDEA Conf 2024 | 2024-03-06 |
Live demo shows SQL injection via concatenation that fixed only when using prepared statements plus parameterized queries, a file upload exploit where a… | ||
| Stranger Danger: Your Attack Surface Just Got Bigger | DevWorld 2024 | 2024-02-29 |
Java examples demonstrate concrete failures: unsanitized request parameters cause cross-site scripting, file uploads allow path traversal to escape an upload… | ||
| Ignite sessions | J-Fall 2023 | 2023-11-09 |
Seven fast pitches cover practical wins and failures: one developer deprecated my library after finding an existing GitHub project and used OpenRewrite to… | ||
| Stranger Danger: Your Java Attack Surface Just Got Bigger | Voxxed Days Cluj 2023 | 2023-10-11 |
Live demos show how small coding shortcuts and stale dependencies lead to full takeover: an unchecked response writer enables reflective XSS, a naive multipart… | ||
| PANEL: Unleashing the Future: The Impact of Gen AI on Development Productivity | Voxxed Days Cluj 2023 | 2023-10-11 |
Panel reports developers using co-pilot and ChatGPT daily but finding concrete limits: generated code sometimes introduces SQL injection and XSS because models… | ||
| J-FALL Official Opening | J-Fall 2022 | 2022-11-03 |
Grand opening sets scale and logistics: 1800 attendees, 60 sessions from 50 speakers and an exhibition with about 40 business partners. Program committee… | ||
| Live Hacking: Breaking into Your Web App | GOTO Amsterdam 2022 | 2022-06-12 |
Live hacking demos exploit real weaknesses in a sample app (Goof) to show how common supply‑chain choices bite: crafted HTTP headers trigger OGNL header RCE… | ||
| Stranger Danger: Securing Your Java Containers by Breaking In | Jfokus 2022 | 2022-05-02 |
Docker images often carry full OS packages and old libraries so a Java container can expose real attack paths: a Debian-shipped ImageMagick allows an image… | ||
| DevSecOps | Devnexus 2022 | 2022-04-12 |
Live demos show an RCE via an Apache Struts OGNL header against a Heroku app, a zip path traversal overwrite of native2ascii, and a Tomcat 8.5.21 base-image… | ||
| Security Warning: Your Java Attack Surface Just Got Bigger | FOSDEM 2022 | 2022-02-05 |
Building cloud-native Java applications is undoubtedly awesome.
However, it comes with undeniable new risks. Next to your own code, you are relying on so many… | ||
| Securing Containers by Breaking In | Conf42 Cloud Native 2021 | 2021-04-29 |
Live hacks show real outcomes: outdated binaries lead to code execution (an ImageMagick RCE breaks out to run scripts and spawn a shell via netcat), Spring… | ||
| Premiere - Conf42 Enterprise Software 2021 | Conf42 Enterprise Software 2021 | 2021-03-25 |
One videocast bundles ~20 short talks and a live demo: a rookout walkthrough shows rookout non‑breaking breakpoints that collect snapshots without redeploy… | ||
| Live hacking: Breaking into your Java web app | Conf42 Enterprise Software 2021 | 2021-03-25 |
Live demos exploit Apache Struts RCE to run arbitrary OS commands on a Heroku instance (curl shows environment vars, /etc/passwd), a zip slip overwrite… | ||
| Live Hacking: Breaking into your Web App | Developers Summit 2021 | 2021-02-18 |
A deliberately vulnerable sample app called Goof uses real-world modules and the demo exploits them live: an Apache Struts OGNL RCE lets curl-triggered… | ||
| Securing Containers by Breaking In | Devnexus 2021 | 2021-02-17 |
Scans of popular Docker Hub images show every image contains known OS vulnerabilities and 44% of those are fixed by switching to a newer base; rebuilding fixes… | ||
| 5 Tips to Create Secure Docker Containers for Java Developers | FOSDEM 2021 | 2021-02-06 |
Docker is the most widely used way to containerize your application.
With Docker Hub, it is easy to create and pull pre-created images. This is very… | ||
| Know thy neighbours: dependency management done right. | Devoxx Ukraine 2020 | 2020-11-05 |
A 222‑line demo app with five direct dependencies pulls in 54 total artifacts and ends up shipping roughly ~450,000 lines of third‑party code, so… | ||
| Securing Containers by Breaking in | J-Fall Virtual 2020 | 2020-11-03 |
Live demo exploits an ImageMagick RCE to escalate from an uploaded JPEG to a shell, proving containerized apps inherit OS flaws. Research shows Node images… | ||
| Live hacking: Breaking into your Java web app | Global Summit for Java Devs 2020 | 2020-08-01 |
Live demos exploit real Java apps: a crafted Content-Type abuses Apache Struts OGNL RCE to spawn ProcessBuilder on Heroku, a PATCH to a Spring Data REST… | ||
| Live Exploiting Your Open Source Dependencies | CodeLand 2020 | 2020-07-23 |
Shows a runnable sample app (Goof) on Heroku and demonstrates an Apache Struts OGNL RCE that runs arbitrary bash, plus a zip‑slip overwrite that replaces the… | ||
| Live hacking: Breaking into your web app | Codemotion Berlin 2019 | 2019-11-12 |
Live demos exploit an outdated Apache Struts header using OGNL to invoke Java ProcessBuilder via curl and execute arbitrary shell commands on a Heroku instance… | ||
| 10 Excellent Ways to Secure Your Spring Boot Application | Devoxx Belgium 2019 | 2019-11-04 |
Covers concrete fixes: enable TLS everywhere using Let's Encrypt and certbot (including localhost cert tips), run dependency scanning (demo finds 12 high… | ||
| Live hacking: Breaking into your Java web app | Devoxx Belgium 2019 | 2019-11-04 |
Live demos exploit real flaws: a crafted content-type uses Apache Struts RCE and OGNL to run /bin/bash on Heroku, a zip upload triggers zip slip to overwrite… | ||
| Live Hacking: Breaking into Your Web App | Heapcon 2019 | 2019-10-03 |
Demo shows concrete, reproducible breakins: path traversal via URL‑encoded ../ to read /etc/passwd and package.json, ReDoS with a 60,000‑char regex payload… | ||
| Ten Common mistakes made in Functional Java | Jfokus 2019 | 2019-02-04 |
Ten concrete Java pitfalls with fixes and code patterns: avoid large block lambdas — extract named methods; stop returning Streams as reusable data; never rely… | ||
| Ten Common Mistakes Made in Functional Java 1 | Oracle Code One 2018 | 2018-10-22 |
A list of concrete anti-patterns and fixes for Java 8/9 functional code: avoid large block lambdas—extract a named method and use a method reference; return… | ||
| Java 8: the good, the bad and the ugly | Devoxx Belgium 2017 | 2017-11-06 |
Java 8 adds lambdas, Optionals and streams but the talk gives actionable limits: lambdas replace boilerplate but avoid block lambdas and prefer single-line or… | ||
| nothing matches | ||