Security
Secure File Upload Handling
A defense-in-depth checklist for handling user-uploaded files safely, covering validation, storage, serving, and the mistakes that lead to real compromises.
3 min read
Category
Security
14 articles
Security
Dependency Risk: Lockfiles, Audits, and SBOMs
How lockfiles, dependency audits, and software bills of materials work together to manage the risk of running someone else's code in production.
3 min read
Security
SSRF: The Cloud-Era Vulnerability and Its Defenses
Why server-side request forgery became a top-tier risk in the cloud metadata era, and the layered defenses that actually contain it.
3 min read
Security
Security Headers: CSP, HSTS, and Frame Options, and What Each Stops
A practical walkthrough of the HTTP security headers that matter most, what specific attack each one mitigates, and how to roll them out without breaking your site.
3 min read
Security
Password Storage: bcrypt, scrypt, Argon2, and Why Plain Hashing Fails
Why fast general-purpose hashes like SHA-256 are unsafe for passwords, and how bcrypt, scrypt, and Argon2 defend against modern offline cracking hardware.
3 min read
Security
OAuth 2.0 and OpenID Connect: Flows Explained for App Developers
A practical guide to OAuth 2.0 and OpenID Connect flows for application developers, covering authorization code with PKCE and why implicit flow is obsolete.
3 min read
Security
TLS for Backend Developers
Most backend engineers treat TLS as something a load balancer handles — until a service-to-service call or a certificate expiry proves otherwise.
3 min read
Security
SQL Injection Prevention Beyond Prepared Statements
Parameterized queries solve the classic SQL injection case, but ORMs, dynamic identifiers, and second-order injection still find ways through.
3 min read
Security
Software Supply Chain Security Basics
Your application's attack surface includes every package your dependencies depend on — here's what to actually check before trusting a build.
3 min read
Security
Secrets Management for Application Developers
API keys and database passwords leak through predictable channels — git history, logs, error messages — long before an actual attacker gets involved.
3 min read
Security
JWT Security Pitfalls and Hardening
JSON Web Tokens are easy to misuse in ways that look correct in a demo and fail catastrophically in production — a walkthrough of the common mistakes.
3 min read
Security
CSRF: When You Still Need to Care
SameSite cookies made CSRF less of a default threat, but the attack is far from dead for APIs using cookie auth, subdomains, or older browsers.
3 min read
Security
XSS Prevention in Modern Frameworks
React, Vue, and Angular auto-escape by default, but every one of them has an escape hatch that reintroduces XSS — here's where those hatches hide.
3 min read
Security
The OWASP Top 10 as a Code Review Checklist
A practical translation of the OWASP Top 10 into concrete questions you can ask during pull request review, not just categories to memorize.
3 min read