Your recipe for BApp Store success
Summary: PortSwigger published guidance for developers submitting extensions to the BApp Store, advising them to avoid duplicating existing or core Burp features and to use descriptive names rather than playful ones like 'PsychoPATH'. The post also warns that some submissions contained flaws such as XXE, and that extensions should treat HTTP message content as untrusted and perform slow operations on background threads rather than the Swing Event Dispatch Thread.
What's compelling: Users test sites they don't trust, and submitted extensions have carried XXE flaws a malicious site could exploit - so every BApp a tester installs is code running against hostile input inside their Burp instance.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026