Semgrep eventsJoin Semgrep security researchers, advocates, and engineers who are attending DEF CON.
We like to hang out in the AI Village, IoT Village, and AppSec Village to learn about weird edge cases in the wild, tools folks are using, how people are responding to the latest AI models and more.
Let’s debate, share stories, and nerd out.
📍 LVCC West Hall
🗓 August 6-9
Here’s where you can catch the Semgrep team on stage:
🗣️ Diptendu Kar, Security Researcher
Aug 7 • 4:30pm - 5:00pm • Crypto & Privacy Village, Stage 2
"Crypto Is Fine. The Code Is Not: Real-World Cryptographic Failures"
Cryptography has a reputation for being intimidating, mathematical, and difficult to reason about. In reality, many cryptographic failures in production systems have very little to do with cryptography itself. They happen because of small implementation mistakes such as skipping a validation check, trusting unvalidated input, or selecting the wrong algorithm.
In this talk, we take a practical and data-driven look at the OWASP Cryptographic Failures category using GitHub Security Advisories collected as of January 2026. We begin with a brief overview of how these vulnerabilities are distributed across CWEs, then focus on two of the most common failure patterns. Using real vulnerable open source libraries, we examine signature verification bypasses and algorithm confusion bugs.
Rather than only showing exploits, this talk actively involves the audience. For each case study, we pause at key moments and work through the vulnerability together, asking questions like what inputs could be sent or what assumptions might be broken. Live demos and CTF-style challenges are used throughout, making the session interactive and approachable even without a cryptography background.
🗣️ Dr. Katie Paxton-Fear, Staff Security Advocate & Max vonBlankenburg, Security Researcher
Aug 8 • 2:30pm - 3:00pm • Bug Bounty Village, Stage 6
"Slop Spotting, Using Rules to Detect AI Slop for Bug Bounty"
After curl shut down its HackerOne program in January 2026 under a wave of AI-generated reports — some weeks saw seven reports in sixteen hours, none valid — Katie and Max are introducing Slop Spotting: a lightweight triage method that uses SAST rule generation as a validity signal. The core idea: if a vulnerability is real and well-specified, you should be able to write a SAST rule for it and get a result. If it's slop, even convincing slop, you get a fast no. Anyone who's watched a maintainer drown in obviously-fake reports will recognize the problem immediately.
🗣️ Dr. Katie Paxton-Fear, Staff Security Advocate
Aug 8 • 3:15pm - 3:45pm • IoT Village Stage 3
"Beyond Your Bookshelf: Hackable eReaders"
Kindles, Kobos, Boox and BigMes, there's no shortage of eReaders to choose from in 2026, with their paper-like eInk displays designed for one thing: reading books. But underneath that minimalist surface sits a surprisingly hackable IoT device! But when it comes to these devices there are a few quirks, from the locked-down Kindle in need of a jailbreak, to the xteink's open source Crosspoint firmware.