u/These-Loquat1010

My company, a Series B cybersecurity startup, is developing some kind of AI/LLM-based pentesting tool using open-source security tools. Before releasing it, they want to test it against an internal CRM I developed.

It sounds like they want to run it directly on the production server. I was asked to arrange a server snapshot, database backup, recovery plan, and notify users that the CRM may be unavailable during testing. The CRM has around 50 active users.

This is my first time dealing with pentesting, but running an automated pentest directly against production seems like a bad idea to me. Again I’m not very familiar with pentesting so I might be missing something.

Wouldn’t it make more sense to create an isolated environment that closely mirrors production, for example by restoring a VM/server snapshot and a copy of the database, and run the pentest there instead?

I’ve asked ChatGPT and Claude about this, but I’m still not sure what the standard real-world approach is, so I’d appreciate input from people who actually work in pentesting or AppSec.

I’ve also asked a few coworkers, but I haven’t really gotten a clear answer. Some of them actually insist that we should just run it on production, which is why I wanted to ask people with more experience in this area.

Is running this kind of automated pentest directly against production normal, or would you generally test against a cloned environment instead?

My coworker is setting up an internal Slack app and keep getting these errors in the Slack Developer Portal:

developer.apps.oauth.getAppStatus not ok: internal_error developer.apps.oauth.getTokens not ok: internal_error

I made sure she set up all the required permissions correctly, including the bot scopes, event subscriptions, and Socket Mode.

One thing that might be relevant: the person currently setting up the app is a Slack Guest user, not a regular workspace member. Could that be causing this issue?

Has anyone seen this before or know what causes it?

Thank you for your help

I’m currently working as a full-stack developer at a Series B cybersecurity startup. I’ve been here for about a year and a half, and I hate pretty much everything about the job.

Management is awful. A lot of the people I work with are unpleasant, passive-aggressive, arrogant, and extremely micromanaging. The culture honestly feels more like the military than a company. We have a turnover rate of around 38% last year, and I wouldn’t be surprised if we beat that this year. There are tons of people who don’t even last a year here.
The CEO and upper management regularly bad-mouth and belittle employees. The CEO has even threatened employees with defamation lawsuits if they post negative reviews about the company online. The company is only surviving because there’s a small group of people who are extremely loyal to him, while everyone else eventually runs away after spending a year or two here.

We don;t have real development process. Everything ultimately has to match the CEO’s personal tastes. It doesn’t matter how much work you put into something, how good the implementation is, or whether it improves the product. If he personally doesn’t like it, it does't matter. Also, what’s kind of shocking is that even though we’re supposed to be a cybersecurity company, some of our own dev practices are insanely lax. Some servers don’t have proper snapshots or backups, and people can basically get sudo access as long as they ask for it. Unsurprisingly, things fail all the time at our company. One of our biggest customers even threatened to stop using our service because our services constantly break down and don;t work as advertised.

We have a CTO who’s supposed to be responsible for the engineering culture, but he’s pretty absent and honestly doesn’t seem to care that much about the job. He’s also a close friend of the CEO and very loyal to him, and he delegates a lot of the actual technical decision-making to this senior DevOps engineer. Without this engineer, I genuinely think the company would fall apart within a few days.

Even basic workplace policies are weirdly controlling. Senior employees are allowed to work remotely, but they’re expected to send daily reports detailing what they did. If you want to come into the office early, you’re supposed to get your manager’s approval first. Also, the CEO literally disabled Slack’s edit feature because he believes employees use that feature to go back and lie. So if you make a typo or send something by mistake, you’re basically stuck with it. One time, I accidentally sent a pretty embarrassing message in a public Slack channel so asked my manager if he could delete it for me

I’ve been interviewing here and there, but the job market has been very brutal as of lately. I did get an offer from a smaller Series A startup recently, but the pay wasn’t great and the company was even smaller than my current one, so I ended up turning it down. I regret that decision now.

I graduated with a master’s in CS with a pretty low GPA (3.2). I had a rough first semester and got a C in one class, which really hurt my GPA, and I never fully recovered from it. I also got another C in a group-project-heavy class that didn’t go very well because I was the only person who was doing all the work for that stupid class which affected the entire course grade.

Since then my grades have had a upward trajectory.

I know people often say that getting Cs in a master’s program is unusual, but at my program that wasn’t necessarily the case. Some classes were curved, and the bottom portion of the class could end up with Cs rather than Bs if they are not careful. This was also during the pandemic, which definitely didn’t help.

I’m wondering if anyone here has gotten into a PhD program despite having a relatively low master’s GPA. Also, my undergrad GPA was 3.5

I am not looking to get into CS PhD programs. I’m more interested in areas like HCI, Information Science, or Information Studies.

Would love to hear from anyone who had a similar academic record and was still able to get into a PhD program.

학창 시절 대부분을 미국에서 보냈고, 미국에서 대학교와 대학원까지 나온 뒤 현재 한국에서 60명 정도 규모 정보보안 스타트업에서 전문연구요원으로 근무 중임.

한국 회사는 지금 직장이 처음인데 조직문화 적응이 진짜 너무 어려움. 최근에는 우울감, 불안, 불면증까지 생겨서 치료받고 약 먹은 지도 3개월 정도 됐음.

회사는 스타트업이라고 하는데 의사결정 방식은 웬만한 대기업보다 더 탑다운함. 의견을 내도 제대로 듣지 않고 결국 윗사람이 원하는 방향대로 가야 함. 작은 일도 하나하나 보고하고 승인받아야 하고 마이크로매니징도 심함.

일을 열심히 하고 성과를 내는 것보다 윗사람한테 잘 보이는 게 더 중요해 보임. 일을 잘해도 인정받기 어렵고, 반대로 일을 못해도 그냥 일 못하는 사람으로 취급받음. 위에 있는 사람들이 본인이 직접 뽑은 직원들까지 뒤에서 까고 뒷담하는 모습을 한국에 와서 처음 봄. 한국 와서 처음 크게 느낀 게 회사에서는 사람을 진짜 조심해야 한다는 거였음.

내부에서 들은 바로는 작년 퇴사율이 38% 정도였다고 함. 사람들이 계속 나가니까 제대로 된 인수인계가 안 되고, 유지보수가 이루어지지 않음

제품도 솔직히 그렇게 훌륭한지 모르겠음. 해외 SaaS 제품을 많이 카피해서 한국화한 느낌인데, 근데 제품이 제대로 작동하지 않는 경우가 많음. 실제로 이름 있는 고객사 한 곳에서 제품이 계속 망가지고 작동하지 않으니까 계약 해지까지 협박 한점이 있음.

그런 상황인데도 요즘 경영진은 AI와 바이브 코딩에 완전히 빠져 있음. 모든 제품에 AI를 넣으려고 하고 개발도 바이브 코딩 위주로 가는 분위기임. 코드 리뷰 문화는 거의 없고 QA도 대부분 사람이 직접 손으로 확인하는 수준임. 당연히 기능 하나 고치면 다른 곳이 망가지는 일이 계속 반복됨.

위에 있는 사람들은 본인들이 IT 대기업 출신이라는 존나 자랑 하는데 실제 개발 프로세스나 기술적 의사결정을 보면 솔직히 잘 믿기지 않음.

미국에서 대학교와 대학원을 다니면서 스타트업과 대기업 인턴 + co-op, 실무 경험을 합쳐 네 번 정도 해봤는데 이런 회사는 정말 처음임. 한국에 온 선택 자체를 후회할 정도로 힘든 상태임.

내가 한국 직장문화에 적응을 못하는 건지, 아니면 이 회사가 유독 이상한 건지 모르겠음.

학창 시절 대부분을 미국에서 보냈고, 미국에서 학부와 대학원까지 나온 뒤 현재 한국에서 60명 정도 규모 정보보안 스타트업에서 전문연구요원으로 근무 중임.

한국 회사는 지금 직장이 처음인데 조직문화 적응이 진짜 너무 어려움. 최근에는 우울감, 불안, 불면증까지 생겨서 치료받고 약 먹은 지도 3개월 정도 됐음.

회사는 스타트업이라고 하는데 의사결정 방식은 웬만한 대기업보다 더 탑다운함. 의견을 내도 제대로 듣지 않고 결국 윗사람이 원하는 방향대로 가야 함. 작은 일도 하나하나 보고하고 승인받아야 하고 마이크로매니징도 심함.

일을 열심히 하고 성과를 내는 것보다 윗사람한테 잘 보이는 게 더 중요해 보임. 일을 잘해도 인정받기 어렵고, 반대로 일을 못해도 그냥 일 못하는 사람으로 취급받음. 위에 있는 사람들이 본인이 직접 뽑은 직원들까지 뒤에서 까고 뒷담하는 모습을 자주 봄. 한국 와서 처음 크게 느낀 게 회사에서는 사람을 진짜 조심해야 한다는 거였음.

내부에서 들은 바로는 작년 퇴사율이 38% 정도였다고 함. 사람들이 계속 나가니까 제대로 된 인수인계가 안 되고, 유지보수가 이루어지지 않음

제품도 솔직히 그렇게 훌륭한지 모르겠음. 해외 SaaS 제품을 많이 카피해서 한국화한 느낌인데, 근데 제품이 제대로 작동하지 않는 경우가 많음. 실제로 이름 있는 고객사 한 곳에서 제품이 계속 망가지고 작동하지 않으니까 계약 해지까지 협박 한점이 있음.

그런 상황인데도 요즘 경영진은 AI와 바이브 코딩에 완전히 빠져 있음. 모든 제품에 AI를 넣으려고 하고 개발도 바이브 코딩 위주로 가는 분위기임. 코드 리뷰 문화는 거의 없고 QA도 대부분 사람이 직접 손으로 확인하는 수준임. 당연히 기능 하나 고치면 다른 곳이 망가지는 일이 계속 반복됨.

위에 있는 사람들은 본인들이 IT 대기업 출신이라는 존나 자랑 하는데 실제 개발 프로세스나 기술적 의사결정을 보면 솔직히 잘 믿기지 않음.

미국에서 대학교와 대학원을 다니면서 스타트업과 대기업 인턴 + co-op, 실무 경험을 합쳐 네 번 정도 해봤는데 이런 회사는 정말 처음임. 한국에 온 선택 자체를 후회할 정도로 힘든 상태임.

내가 한국 직장문화에 적응을 못하는 건지, 아니면 이 회사가 유독 이상한 건지 모르겠음.

Context:

I'm a junior full-stack developer with about 1.5 years of experience working at a ~60-person Series B cybersecurity startup.

I'm currently building an internal CRM for our sales team. The CRM manages contracts, partners, resellers/subcontractors, sales stages, customer information, etc. Before this, a lot of the process was spread across Excel spreadsheets and Slack messages and emails.

Problem:

The thing that's been driving me crazy as of lately is our security review process.

Any time I implement a feature that even touches or deals with customer information, I have to go back and forth with our internal security team before it can move forward.

A typical conversation looks something like this:

Me: "I'd like to store this field and use this"

Security: "Why do you need to store it?"

Me: revises the design

Security: "What's the retention period?"

Me: answers

Security: "This field needs to be encrypted?"

Me: implements encryption

Security: "Who can access it?"

Me: updates the implementation again and rewrite this part of the codebase

Security: "After X numbers of days, customer information need to be deleted and also you need to keep a log of everyone's activities in this crm"

Me: Implements this feature even though we are literally 2 days before launching this crm.

...and so on until it's approved.

They usually respond within a day, so it's not that they're ignoring me. It's just the constant back-and-forth that is driving me crazy I would propose things like data retention periods, deletion policies, audit logging behavior, etc., and then revising them and codebase based on feedback.

Recently, I got scolded by my PM for spending too much time on the CRM and was told that I needed to move faster. The problem is that a significant amount of my time is spent going back and forth over security requirements, while at the same time the sales manager and sales team keep requesting additional features and changes (Literally two days before launching this crm to our partners). I’m constantly trying to balance new feature requests with security reviews, implementation changes, and compliance-related work, so it feels difficult to make any progress because you are constantly changing the codebase.

My previous internship didn't have anything close to this level of review, so I honestly don't know what's normal. Is this just what it's feels like to develop software in security/compliance-heavy environments? Or is this more of a sign that our company is dysfunctional. I have no idea. I'd especially love to hear from engineers at larger companies or other cybersecurity firms because I personally don;'t think this level of review is normal at all.

I’m a junior full-stack engineer with about 1.5 YOE.

I’m currently at a cybersecurity startup with around 60 employees. The company is Series B and is trying to IPO right now, at least from what I understand (But the revenue is not where it should be).

Long story short, I made a huge mistake at work, and it damaged my relationship with the CEO and the company. Since then, I’ve been looking for a new role.

The job market has been pretty rough. Over the past month, I’ve applied to around 20 places, done 2 AI interviews and 2 real interviews, and got rejected from all of them. I also feel like I’ve been unlucky with the interview questions because some of them felt like they were meant for senior engineers, not someone at my level.

I finally received an offer for a full-stack position at another startup. It’s a small IoT company with around 30 employees and is currently Series A (Pilot phase/pre-commercialization/backed by a well-known deep tech venture capital (VC)). I did some research into the product and technology, and it seems very reasonable.

My main concern is this: if I accept the offer, I’d be moving from a 60-person Series B cybersecurity company to a 30-person Series A IoT startup.

I’ve been told by some friends and family members that moving to an even smaller startup than my current one could hurt my future career prospects. Basically, the concern is that when I eventually try to move to a bigger or more established company, they might see this as a step down and it could work against me.

Is that actually true? Do recruiters or hiring managers care that much about company size/stage, or do they mostly care about what I worked on and what skills I built?

I’m trying to figure out if taking this offer is a reasonable risk, or if I’m just panic-jumping because my current situation is bad.