AppSec on Code and Cypherhttps://codeandcypher.com/tags/appsec/Enterprise cybersecurity research by Joshua A. Wortz, CISSP: Zero Trust, cloud security, DevSecOps, threat defense, and AI-security education.Code and Cypherhttps://codeandcypher.com/images/papermod-cover.pnghttps://codeandcypher.com/Hugoen-usFri, 02 Oct 2026 15:48:11 -0700Acuity Health: Part 3 — STRIDE Threat Modeling & BOLA Eliminationhttps://codeandcypher.com/series/acuity-health-security-architecture/part-3-threat-modeling-stride-api-security/Tue, 22 Sep 2026 00:00:00 -0700https://codeandcypher.com/series/acuity-health-security-architecture/part-3-threat-modeling-stride-api-security/Map trust boundaries with STRIDE during sprint grooming, protect data flows, and prevent Broken Object Level Authorization (BOLA) in modern healthcare APIs.Bridging the Browser-to-Boundary Gap: From Client-Side SPA State Reconnaissance to Safe Harbor Verificationhttps://codeandcypher.com/posts/client-side-spa-recon-and-safe-harbor-verification/Sat, 12 Sep 2026 09:00:00 -0700https://codeandcypher.com/posts/client-side-spa-recon-and-safe-harbor-verification/How to hunt client-side SPA state in DevTools with StateHunter and enforce mathematical scope boundaries and Safe Harbor adherence with AuditGuard.Designing a Secure Software Development Program: Acuity Health AppSec Frameworkhttps://codeandcypher.com/papers/designing-a-secure-software-development-program/Mon, 06 Jul 2026 00:00:00 -0700https://codeandcypher.com/papers/designing-a-secure-software-development-program/An engineering framework operationalizing NIST SP 800-218 (SSDF), CI/CD quality gates, and OWASP API security defenses in a healthcare delivery organization.Software Security Metrics, Technical Debt Quantification, and Program Maturityhttps://codeandcypher.com/papers/csol560-risks-and-metric-in-software-systems/Mon, 08 Dec 2025 00:00:00 -0700https://codeandcypher.com/papers/csol560-risks-and-metric-in-software-systems/Quantitative framework for software security metrics, technical debt measurement, and AppSec maturity assessment (OpenSAMM/BSIMM).Ransomware Simulator: Cryptographic Attack Modeling and Application-Level Defenseshttps://codeandcypher.com/papers/csol560-ransomware-simulator/Sun, 30 Nov 2025 00:00:00 -0700https://codeandcypher.com/papers/csol560-ransomware-simulator/Engineering design and safe execution of a controlled ransomware simulation framework to validate endpoint detection and backup resilience.Static Application Security Testing (SAST) and Secure Web Application Designhttps://codeandcypher.com/papers/csol560-static-analysis-of-a-website-secure-design/Mon, 24 Nov 2025 00:00:00 -0700https://codeandcypher.com/papers/csol560-static-analysis-of-a-website-secure-design/Static application security testing (SAST) methodology and secure web application architecture aligned with OWASP Top 10 guidelines.Threat Modeling and Architectural Risk Analysis: STRIDE and DREAD Applicationshttps://codeandcypher.com/papers/csol560-risks-threats-vulnerabilities/Mon, 17 Nov 2025 00:00:00 -0700https://codeandcypher.com/papers/csol560-risks-threats-vulnerabilities/Architectural threat modeling applying STRIDE and DREAD frameworks to identify vulnerabilities and prioritize engineering mitigations.Secure Software Development Life Cycle (SSDLC): Comparative Analysis of Microsoft SDL and Apple Ecosystemshttps://codeandcypher.com/papers/csol560-secure-software-development-life-cycle-ssdlc-microso/Fri, 14 Nov 2025 00:00:00 -0700https://codeandcypher.com/papers/csol560-secure-software-development-life-cycle-ssdlc-microso/Comparative analysis of Secure Software Development Life Cycle models, contrasting Microsoft SDL with Apple secure development practices.Compromised Network Indicators and Secure Application Risk Mitigationshttps://codeandcypher.com/papers/csol560-compromised-network-indicators-and-risk-mitigations/Mon, 03 Nov 2025 00:00:00 -0700https://codeandcypher.com/papers/csol560-compromised-network-indicators-and-risk-mitigations/Technical analysis of Indicators of Compromise (IoCs), lateral movement detection, and host-based risk mitigation playbooks.Secure Software Development Life Cycle (SDLC) Phase Analysis and Control Gateshttps://codeandcypher.com/papers/csol560-csol-560-module-1-assignment-table/Mon, 27 Oct 2025 00:00:00 -0700https://codeandcypher.com/papers/csol560-csol-560-module-1-assignment-table/Comparative evaluation of eight software development life cycle (SDLC) models across requirement volatility, risk management, and security control integration.