Every article tagged Security, in one place.
Showing 26 articles
The OWASP Top 10 is a widely used awareness list of the most critical web application security risks, based on data from real applications. It's updated every few years; the 2025 edition reflects how modern apps are built, with supply chains and cloud configur...
Broken access control means a user can do something they shouldn't be allowed to. The most common form is IDOR (insecure direct object reference): change an ID in a request and see someone else's data. The vulnerable pattern // GET /api/invoices/1043 app.get('...
The same image should run in development, staging and production. What changes between them (URLs, feature flags, credentials) belongs in ConfigMaps and Secrets. ConfigMap for non-sensitive settings apiVersion: v1 kind: ConfigMap metadata: name: api-config dat...
SQL injection happens when user input is pasted into a SQL string, letting an attacker change the query itself. It's old, well understood and still found in production code. The vulnerability // email comes from a login form const sql = `SELECT * FROM users WH...
Workflows need configuration (URLs, flags) and credentials (API keys, deploy tokens). GitHub provides separate tools for each, plus environments to control who and what can deploy where. Secrets and variables Secrets are encrypted, masked in logs and not reada...
Cross-site scripting (XSS) lets an attacker run their JavaScript in other users' browsers on your site. With it they can read data on the page, act as the user, or steal tokens kept in JavaScript-accessible storage. How it happens // A comment saved as: <img s...
Short-lived access tokens limit damage if one leaks, but users don't want to sign in every 15 minutes. Refresh tokens bridge the gap, and rotation keeps them safe. The idea Sign-in returns a short-lived access token (for example 15 minutes) and a refresh token...
Storing cloud access keys as GitHub secrets works, but those keys live forever and can leak. With OpenID Connect (OIDC) , GitHub gives each workflow run a signed token, and your cloud exchanges it for temporary credentials. There are no keys to steal or rotate...
Cross-site request forgery (CSRF) tricks a logged-in user's browser into sending a request to your site from another site. Because browsers attach cookies automatically, the request arrives with the victim's session. The attack <!-- on evil.example --> <form a...
Time-based one-time passwords (TOTP) are the six-digit codes from apps like Google Authenticator, Microsoft Authenticator or 1Password. They stop most account takeovers that start with a stolen password. How TOTP works Your server and the user's app share a se...
Many features fetch a URL on the user's behalf: link previews, "import from URL", webhooks, PDF generators. If an attacker controls the URL, they can make your server request internal addresses it can reach but they can't. That's server-side request forgery ....
"Forgot password" is a back door into every account, so it deserves as much care as the login form. 1. Requesting a reset import { randomBytes, createHash } from 'node:crypto'; const sha256 = (s) => createHash('sha256').update(s).digest('hex'); app.post('/auth...
An agent can only do what its tools allow. Good guardrails assume the model will sometimes make mistakes or be manipulated, and limit the damage when it does. 1. Least privilege Give each agent only the tools its job needs. Scope credentials: a read-only datab...
Containers isolate processes, but a careless image or run command can undo most of that protection. These practices close the common gaps. 1. Don't run as root RUN addgroup -S app && adduser -S app -G app USER app If an attacker exploits your app, they get the...
Many breaches don't need a clever exploit, just a setting left at the wrong value. Security misconfiguration is consistently near the top of the OWASP list. 1. Send security headers Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Securit...
JWTs are easy to issue and easy to get wrong. Most JWT vulnerabilities come from how tokens are verified, not from the format itself. 1. Always verify, and pin the algorithm import jwt from 'jsonwebtoken'; // Wrong: decode() does NOT check the signature const...
Most API breaches come from a few well-known mistakes. Work through this checklist for every Node.js service you deploy. 1. Validate every input import { z } from 'zod'; const CreateOrder = z.object({ productId: z.uuid(), quantity: z.number().int().min(1).max(...
CI pipelines hold deploy credentials and write access to your code, which makes them attractive targets. These practices close the most common holes. 1. Least-privilege GITHUB_TOKEN permissions: contents: read # default for the whole workflow jobs: release: pe...
A typical JavaScript or Python app runs far more third-party code than first-party code. Attackers know this: compromised maintainer accounts, typosquatted packages and poisoned build pipelines have all hit popular ecosystems, including several high-profile np...
Authentication answers "who are you?". Authorisation answers "may you do this?". As apps grow, a clear authorisation model saves you from permission checks scattered everywhere. RBAC: role-based access control const PERMISSIONS = { admin: ['post:create', 'post...
MCP connects models to real systems, so it inherits real security risks. Some apply to server authors, some to anyone installing servers. Risks for users and host apps Malicious servers. A local stdio server runs with your user's permissions. Only install serv...
Cryptographic failures are rarely about breaking strong maths. They're about not encrypting data at all, using the wrong tool, or handling keys carelessly. 1. Passwords: hash, never encrypt import argon2 from 'argon2'; const hash = await argon2.hash(password,...
Credential stuffing uses username/password pairs leaked from other sites, tried automatically against yours. Because many people reuse passwords, even a small success rate means many hijacked accounts. 1. Layered rate limits import rateLimit from 'express-rate...
Rate limits protect your API from abuse, runaway scripts and accidental traffic spikes, and keep things fair between customers. Common algorithms Fixed window - count requests per calendar minute. Simple, but allows bursts at window edges (100 at 12:00:59 and...
Anyone can set user.email to your address and make commits that look like yours. Signing commits proves they were made by someone holding your private key. Git supports signing with SSH keys, which is much simpler than setting up GPG. 1. Tell Git to sign with...
Two related OWASP risks are about what happens when things go wrong: whether your app fails safely, and whether anyone notices an attack in progress. Fail closed When an error happens during a security decision, the safe default is "deny". // Dangerous: an err...
