Security
SQL Injection Prevention Beyond Prepared Statements
Parameterized queries solve the classic SQL injection case, but ORMs, dynamic identifiers, and second-order injection still find ways through.
3 min read
Tag
Web Security
5 articles
Security
JWT Security Pitfalls and Hardening
JSON Web Tokens are easy to misuse in ways that look correct in a demo and fail catastrophically in production — a walkthrough of the common mistakes.
3 min read
Security
CSRF: When You Still Need to Care
SameSite cookies made CSRF less of a default threat, but the attack is far from dead for APIs using cookie auth, subdomains, or older browsers.
3 min read
Security
XSS Prevention in Modern Frameworks
React, Vue, and Angular auto-escape by default, but every one of them has an escape hatch that reintroduces XSS — here's where those hatches hide.
3 min read
Security
The OWASP Top 10 as a Code Review Checklist
A practical translation of the OWASP Top 10 into concrete questions you can ask during pull request review, not just categories to memorize.
3 min read