RootedCON
MCP Enterprise Security: A Practical Architecture and Lessons to Avoid Being Pwned
A practical security architecture for MCP in the enterprise and what we've learned so you don't get compromised. With Alfonso Muñoz
Conferences
Talks
I've given talks around the world about security, development and AI.
I founded Navaja Negra and the OWASP Madrid chapter. These are the ones people still bring up.
RootedCON
When MCP goes Wrong - Que MCP no rompa tu seguridad
Security in Model Context Protocol (MCP): how design and implementation mistakes can compromise your infrastructure. With Alfonso Muñoz
RootedCON
Censorship, privacy and the fine art of disappearing without trace
Privacy techniques, censorship, anonymity and robust cryptography. With Dr. Alfonso Muñoz
Navaja Negra
Doing fun things with databases
Unconventional ways to exploit databases, beyond deleting data or stealing information
RootedCON
AWS, with its lambdas and its little things
Real AWS Lambda examples: good, bad and terrible practices. With César Gallego
Navaja Negra
Protect your Python... because if it's as bad as it sounds, better nobody sees it
Techniques to protect Python code, from basic methods to building custom Python interpreters
Navaja Negra
Protecting Python Source Code
Techniques to protect Python source code when you publish it, from the simplest to compiling your own Python interpreter
PyConES
Asyncio in production: what nobody tells you
What I've learned using Python Asyncio in production, processing millions of events per day: the good, the bad and the ugly
RSA Conference
Spreading Application Security Ownership Across the Entire Organization
How to spread the responsibility for application security across the whole organization instead of leaving it only with the security team
RootedCON
From the Heaven to Hell in the CI/CD
Critical vulnerabilities in CI/CD pipelines and how an attacker can compromise your whole development and deployment process
RootedCON
Crawlino: The New Level of Crawling Systems
A high-performance distributed crawling system to scout and analyze web applications at scale
RootedCON
Docker Might Not Be Your Friend - Trojanizing Docker Images
How to trojanize Docker images and why your container registry can end up being your worst enemy
OWASP Madrid
I Meetup OWASP Madrid
Technical talk on web application security at the first meetup of the OWASP Madrid chapter
RootedCON
Broker & MQ Injection
I introduce the Broker Injection concept and Enteletaor, a tool to inject, extract and modify information in brokers like Redis, RabbitMQ or ZeroMQ
Cybercamp
Python, Hacking and Sec-tools from the Trenches
Hands-on workshop on building security tools with Python, from basic scripts to professional tools
Codemotion
Your DevOp Gives Me Work: I'm a Security Auditor
How DevOps teams are creating new attack vectors and vulnerabilities that we security auditors end up having to fix