API Security
How to secure your API secret keys from being exposed?
Learn about the dangers of API secret key exposure and discover our selection of prevention strategies.
Alexandra Charikova
Alexandra leads Growth & Community at Escape and hosts The Elephant in AppSec podcast, focusing on application security. She’s active in BSides Amsterdam, OWASP AppSec Days, and contributes security research featured in outlets like Help Net Security
Alexandra Charikova — Last Publications
API Discovery
What is a Shadow API? Understanding the risks and strategies to prevent their sprawl
API Sprawl is a serious challenge in 2024, and shadow APIs are part of the problem. But do you actually know what Shadow APIs are and why they represent danger for organizations? With the ever-increasing number of exposed APIs, the pain of not being able to gain visibility over all of them is creeping up on security engineers. Unfortunately, it's all too common to have APIs in staging and production that no one on your development or security teams remembers or knows about. And if you don't kno
Podcast
Developers and security training: can they co-exist?⎜Laura Bell Main
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today, we’re excited to have an amazing guest, Laura Bell Main, join us. With over 20 years in software development and application security, Laura is the co-founder and CEO of SafeStack, an online education platform that offers secure development training for fast-moving companies. Laura is also a well-known keynote speaker and has spoken at high-profile events like BlackHa
API Discovery
What is API Sprawl? Understanding the growing challenge of 2024 and how to navigate it
Discover the impact of API sprawl in 2024 and learn how to effectively navigate it with expert insights from our team.
Podcast
Adversarial machine learning: what is it and are we ready? ⎜Anmol Agarwal
Today, we're joined by Anmol Agarwal, a security researcher at Nokia. Tune in as we challenge her insights on adversarial machine learning.
Announcement
Join our new Escape community on Slack!
If you're a security professional who enjoys asking questions, sharing your knowledge with others, and is passionate about API security, this group is for you!
API Security
API security for PCI compliance: A deep dive into the PCI DSS 4.0 impact
There are more than 50 new requirements in PCI DSS v4.0 – do you know which ones apply to you and what you need to do to meet them? The March deadline is approaching, and we want to ensure you're fully prepared for the changes ahead. The deadline for compliance in the first phase (with 13 broad new requirements) of PCI DSS 4.0 is March 31, 2024. The implementation deadline for a second phase, comprising requirements of a mostly more technical nature, follows a year later. For the complete lis
API Security
How to secure gRPC APIs
Looking for ways to secure gRPC APIs? Don't worry, we've got you covered! In this article, we will be exploring the topic of gRPC security and its importance in ensuring the security of API endpoints. We will also discuss the role of dynamic application security testing (DAST) tools in securing gRPC APIs and identifying and fixing vulnerabilities before they reach production. What is gRPC? gRPC is a high-performance, open-source RPC (Remote Procedure Call) framework developed by Google.
Podcast
AppSec vendors and CISOs: a love-hate relationship? ⎜Olivia Rose
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today, we're joined by an amazing guest, Olivia Rose. Olivia is an executive leader with more than 20 years of dedicated experience, having served as the former CISO at Amplitude and Mailchimp and currently as the Founder of the Rose CISO Group. Her company offers virtual Chief Information Security Officer (CISO) services, boardroom and leadership communications, assessment
Product updates
Introducing notification rules: You can now tailor your alerts with precision
With our new notification rules feature, it takes just a few simple steps to customize your alerts to focus on what really matters for you and your business.
Application Security
4 lessons from recent application security case studies
Every organization, no matter how big or small, if it's dependent on the software (which is impossible not to be in the modern world), must prioritize software security. Interested in enhancing yours? Want to know how real-world application security challenges are tackled? Let's get straight to the point by examining real-life application security case studies. Dive into our latest blog post, and uncover invaluable insights collected from the recent security incidents. As we can see, a vast ra
API Security
API gateway security: 8 best practices
Are your API gateways well secured? If you have doubts, then they are not. API gateways play a large role in securing the flow of data between clients and backend services. But with the surge in API adoption (nearly 90% of developers are using APIs) and the increasing sophistication of cyber attacks, ensuring the security of your API gateway is more critical than ever. At the enterprise level, most APIs are deployed using API gateways. For instance, a banking application could leverage an API g
Product updates
Implementing real-world authentication scenarios in your scans is now made easy
With our new dynamic authentication token generation feature, it takes just a few simple steps to implement real-world authentication scenarios in your scans.
API Security
Methodology: How we discovered over 18,000 API secret tokens
Hey there! It's just the beginning of the year, but our security research team has been working hard to identify current API security challenges. So for the Escape team, January went under the tagline "API secret sprawl" (we thought it was more fun than"Dry January", and we hope you agree with us 😉). If you're in the security field, you might mention that the beginning of the year usually marks the release of all "State of.. " reports, taking a look at the past year's trends. Instead of coll
Podcast
Security training: Necessary investment or overrated expense?⎥Mel Reyes (Global CEO, CIO, CISO, & CTO with 30 years of experience)
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today, we’re excited to have an amazing guest, Mel Reyes, join us. Mel has navigated through two IPOs and three M&As, worked with several startups, Pepsi and Mercedes, and accumulated a bunch of patents along the way. With more than 30 years of experience in various leadership, advising, and coaching roles, he enjoys building and empowering security teams within organization
Product updates
Now you can easily gain comprehensive insights into your compliance posture
With our new Compliance Matrix feature, it takes just a few simple steps to get full visibility into your organization's compliance posture across all applications.
Podcast
What is ASPM: A breakdown of the current state and its future⎥James Berthoty (Security at PagerDuty)
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today, we're excited to have an amazing guest, James Berthoty, joining us. James has been in technology for over 10 years across engineering and security. An early advocate for DevSecOps, he has a passion for driving security teams as contributors to products. With all his experience, he's currently building Latio tech = a platform helping organizations find the best securit
Podcast
SCADA systems: How secure are the systems running our infrastructure?⎥Malav Vyas (Security Researcher at Palo Alto Networks)
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today, we're excited to have an amazing guest, Malav Vyas, joining us. Malav is a security researcher at Palo Alto Networks, passionate about exploiting and securing systems. Security research is an important part of our day-to-day at Escape. That's why we were very curious when Malav reached out to us and brought up the topic of SCADA systems. In our latest episode with Tr
Application Security
Threat modeling: the future of cybersecurity or another buzzword⎥Derek Fisher (author of The Application Security Handbook)
Welcome to the Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room. Today we’re excited to have an amazing guest, Derek Fisher, joining us. Derek is a cybersecurity leader, a speaker on various cybersecurity topics, and author of the famous “The Application Security Handbook.” Having been a developer before shifting to application security more than a decade ago, Derek has had the unique opportunity of seeing the industry from the perspectiv
Product updates
What’s new - Escape Product Updates
Discover our latest product updates: support for Insomnia collections, WP-JSON schema, and additional business logic security tests. Plus you can now fully benefit from Escape's public API.
Podcast
Security experience: top-down vs bottom-up⎥Jeevan Singh (Rippling, Twilio) ⎥The Elephant in AppSec Podcast
Welcome to the second episode of The Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.
Product Security Roadmap
Webinar Recap: Building your Product Security Roadmap
In-depth recap of our hands-on product security webinar with James Berthoty—gather the best knowledge and insights!
Application Security
What is business logic, and why it's important for application security
Is understanding business logic a critical component of application security? Absolutely. In the world of cybersecurity, business logic is more than just a set of operational directives. It serves as the crucial bridge between an application's technical function and its alignment with strategic business goals. More than that, it's important not only to understand but also to properly secure applications from business logic attacks. A striking example of this was the breach experienced by USPS,
Podcast
The Elephant in AppSec Podcast⎥Lack of effective DAST tools⎥Aleksandr Krasnov (Meta, Thinkific, Dropbox)
Welcome to the first episode of The Elephant in AppSec, the podcast to explore, challenge, and boldly face the AppSec Elephants in the room.
Alexandra Charikova — Events, Talks & Papers
BSidesSF 2026 - More Role Models in AppSec: How to Get It Right (Alexandra Charikova)
The State of Security of Vibe Coded Apps
Escape’s security team scanned 5.6k vibe-coded applications and found 2k high-impact issues & 175 instances of PII. Discover the full report.
What Your Exposed APIs Are Leaking - Alexandra Charikova
