Slides, tools, and links from my OWASP Global AppSec USA 2026 session on securing multi-tenant code-ingestion platforms, the design-side companion to the Scanning the Scanners research.

We fed untrusted repositories to 20 hosted code scanners. Five ran our code or read outside the repo, and all five leaked the vendor's own operational credentials. The write-up behind my Black Hat USA 2026 and OWASP Global AppSec USA 2026 talks.

Slides, tools, and links from my Black Hat USA 2026 briefing on hosted code scanners that execute the untrusted repositories they process.

Using OS patch management in GCP to pivot and maintain access to compute instances.

Source code analysis to find privilege-escalation in 300k sites.

Using DLL hijacking to gain persistence in explorer.exe.