Jim Manico
where else to find them
what they talk about
all 9 in the filters
where they keep going back
- NDC Security2 editions2022–2025
- AppSec California2 editions2014–2015
all 18 in the filters
on a stage with
who talks about the same things
- Katy Anton8 talks
- Aaron Bedra14 talks
- Matt Tesauro19 talks
- Tanya Janca30 talks
- Julien Topçu52 talks
- Erlend Oftedal12 talks
| title | conference | date |
|---|---|---|
| Introduction to AI Security | NDC AI 2025 | 2025-11-11 |
Claims that prompt injection is the primary, novel attack on LLMs and that frontier models are routinely bypassed; demonstrates exploits that steal system… | ||
| React AI | NDC AI 2025 | 2025-11-11 |
Live demo across five frontier models (ChatGPT 5.1, Copilot, Claude, Grok, Gemini) shows raw AI output produces dangerous React patterns: unvalidated hrefs and… | ||
| Securing React: Prompt Engineering for Robust and Secure Code Generation | NDC Security 2025 | 2025-01-20 |
Shows how verbose security rules become reusable prompts, stores them in source control, and applies them before and after generation; demonstrates a live fix… | ||
| Building Secure ReactJS Apps: Mastering Advanced Security Techniques | GOTO Copenhagen 2024 | 2024-09-30 |
Shows how AI prompt engineering produces secure React code: capture precise rules, feed them to models, iterate until prompts enforce low cyclomatic and… | ||
| Using AI for Secure Code Creation: Enhancing Software Security | CPH DevFest 2024 | 2024-08-26 |
Claims AI reduces defects ~40% and boosts productivity ~60% when used with disciplined prompt engineering; a pipeline is built using GPT‑4 for boilerplate… | ||
| Building Secure ReactJS Applications: Mastering Advanced Security Techniques | CPH DevFest 2024 | 2024-08-26 |
Covers concrete fixes: stop putting access control in the client, never embed secrets, and treat URLs as the biggest real-world risk (Google sees ~1/3 of… | ||
| Architecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps | NDC Oslo 2023 | 2023-05-22 |
React's JSX escaping is not a silver bullet: JavaScript URLs in hrefs and active attributes still execute, dangerouslySetInnerHTML with raw input and embedding… | ||
| Cheatsheets Project | OWASP 2022 Global AppSec Europe Virtual Event | 2022-11-04 |
Cheat sheets live on GitHub as markdown, updated by hundreds of contributors, with 42 open issues right now and CI lint checks that gate merges; a pull request… | ||
| The Last XSS Defense Talk | NDC Porto 2022 | 2022-04-25 |
Explains why output-side defenses beat input filtering at scale and gives concrete fixes: use context-aware encoding for HTML/attribute/JS/url, apply DOMPurify… | ||
| Keynote - The Abridged History of Application Security | NDC Security 2022 | 2022-04-06 |
A 50-year timeline shows concrete wins: Polish researchers build the first modern cryptanalysis tools in WWII, 1979 Lint starts static analysis, 1995 SATAN… | ||
| Security Control Enhancements | NDC Security 2022 | 2022-04-06 |
Timeline of concrete Java security changes from Java 8 → 17: SHA‑3 hashing and SHA‑3‑based signatures appear (Java 16), TLS 1.3 and AES‑GCM support mature… | ||
| Keynote: Request Forgery on the Web - SSRF, CSRF and Clickjacking | Global AppSec US 2021 Virtual | 2021-11-08 |
Explains concrete attacks and fixes: Cross‑Site Request Forgery lets an attacker force authenticated actions; defenses that work are synchronizer token… | ||
| Flagship Projects: Cheat Sheet Series | OWASP 20th Anniversary 2021 | 2021-09-24 |
The OWASP Cheat Sheet Series moves off the old wiki into GitHub automation, running hundreds of contributors through scripted editing and review, and maintains… | ||
| : The OWASP Top Ten Proactive Controls 2018 | NDC London 2020 | 2020-01-27 |
Covers the OWASP Top Ten Proactive Controls with actionable specifics: use the ASVS three risk levels, ~200 controls to define requirements; run dependency… | ||
| From the OWASP Top Ten(s) to the OWASP ASVS | NDC London 2020 | 2020-01-27 |
Asserts the OWASP Top Ten is only awareness and not a program and points to OWASP ASVS v4.0 as a concrete standard with 180+ requirements organized into levels… | ||
| AppSec: From the OWASP Top Ten(s) to the OWASP ASVS | GOTO Chicago 2019 | 2019-04-29 |
Claims that the OWASP Top Ten is only entry-level awareness and contrasts it with OWASP ASVS v4.0, a 180+ requirement standard for testing web and API… | ||
| Building Secure React Applications | Jfokus 2019 | 2019-02-04 |
React is not a safe-by-default framework and five common pitfalls enable XSS: unvalidated JavaScript URLs in href/action, use of dangerouslySetInnerHTML… | ||
| The Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years | OWASP AppSec Europe 2018 | 2018-07-02 |
XSS remains pervasive and hard to fix; defense shifts from vague advice to concrete tactics: use DomPurify to wrap dangerous innerHTML (one auditor locks down… | ||
| Secure Software Development Lifecycle | dotSecurity 2017 | 2017-04-21 |
Advocates publishing a simple SDLC as the Brown M&M — a quick checklist that signals whether safety practices exist, and tailoring ASVS (≈200 requirements)… | ||
| Advances in Secure Coding Frameworks | OWASP AppSec California 2016 | 2016-01-25 |
Claims that modern frameworks provide automatic defenses on by default get concrete examples: Rails auto-escapes but HTML safe undermines it, React JSX… | ||
| HTTPS Is Better than Ever Before. Now Its Your Turn. | OWASP AppSec Research (AppSecEU) 2015 | 2015-05-19 |
Claim: HTTPS now gives confidentiality integrity and authenticity when configured correctly. Actionable specifics: update OS and OpenSSL patch Heartbleed and… | ||
| OWASP Top Ten Proactive Controls | AppSec California 2015 | 2015-01-26 |
Gives concrete fixes: use parameterize queries to eliminate SQL injection, encode output per context with the OWASP Java encoder or antixss, and sanitize… | ||
| Proactively defending your business | AppSec California 2015 | 2015-01-26 |
Describes concrete failures and fixes: real incidents (Heartbleed, GoToFail, TurkTrust and the French CA), measurable user behavior (30–70% click through… | ||
| Top Ten Proactive Web Application Controls | AppSec California 2014 | 2014-01-27 |
Project status: OWASP proactive controls in beta with a concrete checklist. Key claims and tools: use query parameterization to eliminate SQL injection, adopt… | ||
| Top Ten Proactive Controls | AppSecUSA 2013 | 2013-11-20 |
The OWASP Proactive Controls lists concrete, testable requirements: adopt query parameterization to eliminate SQL injection, stop using fast salted hashes… | ||
| nothing matches | ||