From the sinister injection flaws reminiscent of "Alien" to the terrifying specter of broken authentication akin to what "The Invisible Man" is capable of, we'll explore the most common security vulnerabilities in web development. But don't worry—we'll also shed light on solutions. If you dare, join us and learn how to conquer the darkness invited by your web applications.

You build applications using Generative AI and LLM frameworks for your JavaScript apps. Hurray! I sure hope you didn’t forget this tiny little thing called application security :-)​Join me in this session, where we uncover imminent security vulnerabilities from basics to hands-on live hacking and demonstrate real-world insecure JavaScript code mistakes as we hack in the IDE and unleash exploit payloads that compromise AI-generated code. You’ll learn and experience prompt injection, LLM agents with excessive access, code vulnerabilities introduced via IDE auto-suggest tools, and how LLM sources turn into an imminent security risk.

When building apps with strict security requirements, developers often default to fully native or brownfield approaches, assuming that JavaScript-based solutions fall short. However, times have changed—many of the security blockers that once limited React Native have been overcome, allowing greenfield apps to achieve the same level of security as their native counterparts.

But security isn’t automatic. Developers must still take deliberate steps to safeguard their apps. By leveraging Expo modules, we can implement critical security features such as secure storage, encrypted networking with TLS pinning, and host whitelisting. Additionally, advanced protections like device assurance, runtime security, and threat monitoring play a crucial role in keeping our apps safe against modern threats—yet many React Native developers remain unfamiliar with them.

In this talk, we’ll explore the essential security technologies available to React Native engineers, demystify key security concepts, and showcase how you can build truly secure mobile applications—without sacrificing the benefits of React Native.

APIs are the backbone of modern software development, allowing you to build innovative applications that seamlessly integrate across ecosystems. As your API becomes the lifeblood of your application, it becomes a prime target for attackers. We'll explore the latest trends in API hacking, including common vulnerabilities, attack vectors, and real-world examples of API breaches. We'll look at best practices which can help to secure your APIs.

Sam Stepanyan is an OWASP Global Board member and an OWASP London Chapter Leader, and an Independent Application Security Consultant and Security Architect with over 20 years of experience in the IT industry with a background in software engineering and web application development. Sam has worked for various financial services institutions in the City of London specialising in Application Security consulting, Secure Software Development Lifecycle (SDLC), developer training, source code reviews and vulnerability management. He is also a Subject Matter Expert in Web Application Firewalls (WAF) and SIEM systems. Sam holds a Master's degree in Software Engineering and a CISSP certification.