DEV Community

Cybersecurity

Articles related to cybersecurity and much more

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
HTTP Verb Tampering in REST APIs: When OPTIONS and HEAD Bypass Access Control
rxkov profile
Rxkov

HTTP Verb Tampering in REST APIs: When OPTIONS and HEAD Bypass Access Control

#api #backend #cybersecurity #security
Comments
5 min read
API Gateway Path Normalization Bypass: When HAProxy Sees /admin and Your App Sees /admin
rxkov profile
Rxkov

API Gateway Path Normalization Bypass: When HAProxy Sees /admin and Your App Sees /admin

#api #architecture #cybersecurity #security
Comments
5 min read
JWT aud Claim Bypass: Cross-Service Token Reuse in Microservice Architectures
rxkov profile
Rxkov

JWT aud Claim Bypass: Cross-Service Token Reuse in Microservice Architectures

#cybersecurity #kubernetes #microservices #security
Comments
6 min read
Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials
rxkov profile
Rxkov

Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials

#api #cybersecurity #infosec #security
Comments
6 min read
Open-Source LLMs Are Unverified Dependencies: The Model Backdoor Gap npm Already Solved
rxkov profile
Rxkov

Open-Source LLMs Are Unverified Dependencies: The Model Backdoor Gap npm Already Solved

#cybersecurity #llm #opensource #security
Comments
5 min read
API Key Scope Validation Failures: When 'Read-Only' Is a Documentation Claim, Not a Backend Constraint
rxkov profile
Rxkov

API Key Scope Validation Failures: When 'Read-Only' Is a Documentation Claim, Not a Backend Constraint

#api #backend #cybersecurity #security
Comments
5 min read
Working: Math.random() Is Not Your Friend: PRNG Prediction and Timing Attacks in API Tokens
rxkov profile
Rxkov

Working: Math.random() Is Not Your Friend: PRNG Prediction and Timing Attacks in API Tokens

#cybersecurity #javascript #security
Comments
5 min read
Working: OTel Spans Are Secret Stores — How Distributed Traces Leak Bearer Tokens to Anyone With Observability Access
rxkov profile
Rxkov

Working: OTel Spans Are Secret Stores — How Distributed Traces Leak Bearer Tokens to Anyone With Observability Access

#backend #cybersecurity #devops #security
Comments
4 min read
CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard
rxkov profile
Rxkov

CORS Misconfiguration in APIs: Why Reflected Origin Plus Credentials Is the Dangerous Pattern, Not Wildcard

#api #cybersecurity #infosec #security
Comments
6 min read
Wayback Machine for OSINT: What Stayed Archived After Remediation
rxkov profile
Rxkov

Wayback Machine for OSINT: What Stayed Archived After Remediation

#cybersecurity #infosec #security
Comments
5 min read
Working: CORS misconfigurations escape automated detection
rxkov profile
Rxkov

Working: CORS misconfigurations escape automated detection

#api #cybersecurity #infosec #security
Comments
5 min read
API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP
rxkov profile
Rxkov

API SSRF: Allowlists Fail Because They Validate the URL, Not the Resolved IP

#api #cybersecurity #infosec #security
Comments
6 min read
JWT Algorithm Negotiation Is a Spec Design Flaw, Not a Library Bug
rxkov profile
Rxkov

JWT Algorithm Negotiation Is a Spec Design Flaw, Not a Library Bug

#cybersecurity #infosec #security
Comments
5 min read
API Log Redaction: Filtering After Serialization Does Not Work
rxkov profile
Rxkov

API Log Redaction: Filtering After Serialization Does Not Work

#api #architecture #cybersecurity #security
Comments
5 min read
JavaScript File Recon: How Frontend Bundles Expose Endpoints, API Keys, and Business Logic
rxkov profile
Rxkov

JavaScript File Recon: How Frontend Bundles Expose Endpoints, API Keys, and Business Logic

#cybersecurity #frontend #javascript #security
Comments
5 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.