DEV Community

Security

Hopefully not just an afterthought!

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Webhook Signature Bypass: When the Receiver Skips the HMAC Check
rxkov profile
Rxkov

Webhook Signature Bypass: When the Receiver Skips the HMAC Check

#api #backend #cybersecurity #security
Comments
5 min read
JWT aud Claim Bypass: Cross-Service Token Reuse in Microservice Architectures
rxkov profile
Rxkov

JWT aud Claim Bypass: Cross-Service Token Reuse in Microservice Architectures

#cybersecurity #kubernetes #microservices #security
Comments
6 min read
Magento 2 API Rate Limiting: Protecting Your Store from Abuse
magevanta profile

Magento 2 API Rate Limiting: Protecting Your Store from Abuse

#magento #security #performance
Comments
6 min read
SAML XSW: Signatures That Validate the Wrong Element
rxkov profile
Rxkov

SAML XSW: Signatures That Validate the Wrong Element

#authentication #cybersecurity #infosec #security
Comments
5 min read
AI Agents Are eval(userInput) With Extra Steps
rxkov profile
Rxkov

AI Agents Are eval(userInput) With Extra Steps

#agents #ai #llm #security
Comments
5 min read
API Key Rotation Leaves Three Records Untouched: Git History, Access Logs, and the Attacker Who Watched the Fix Commit
rxkov profile
Rxkov

API Key Rotation Leaves Three Records Untouched: Git History, Access Logs, and the Attacker Who Watched the Fix Commit

#cybersecurity #git #github #security
Comments
5 min read
HTTP/2 Rapid Reset: How the Protocol Amplifies DoS Against API Gateways
rxkov profile
Rxkov

HTTP/2 Rapid Reset: How the Protocol Amplifies DoS Against API Gateways

#api #cybersecurity #networking #security
Comments
5 min read
Open-Source LLMs Are Unverified Dependencies: The Model Backdoor Gap npm Already Solved
rxkov profile
Rxkov

Open-Source LLMs Are Unverified Dependencies: The Model Backdoor Gap npm Already Solved

#cybersecurity #llm #opensource #security
Comments
5 min read
Working: OTel Spans Are Secret Stores — How Distributed Traces Leak Bearer Tokens to Anyone With Observability Access
rxkov profile
Rxkov

Working: OTel Spans Are Secret Stores — How Distributed Traces Leak Bearer Tokens to Anyone With Observability Access

#backend #cybersecurity #devops #security
Comments
4 min read
Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials
rxkov profile
Rxkov

Postman's Secret Variables Are Not Secret: How Public Workspaces Expose 4,000+ Live Credentials

#api #cybersecurity #infosec #security
Comments
6 min read
HTTP Verb Tampering in REST APIs: When OPTIONS and HEAD Bypass Access Control
rxkov profile
Rxkov

HTTP Verb Tampering in REST APIs: When OPTIONS and HEAD Bypass Access Control

#api #backend #cybersecurity #security
Comments
5 min read
AI Agent Observability Is Off by Default — And That Is a Security Problem
rxkov profile
Rxkov

AI Agent Observability Is Off by Default — And That Is a Security Problem

#agents #ai #monitoring #security
Comments 2
5 min read
Server-Sent Events Security: How EventSource Breaks Your API Authentication Model
rxkov profile
Rxkov

Server-Sent Events Security: How EventSource Breaks Your API Authentication Model

#api #authentication #backend #security
Comments
4 min read
Working: Math.random() Is Not Your Friend: PRNG Prediction and Timing Attacks in API Tokens
rxkov profile
Rxkov

Working: Math.random() Is Not Your Friend: PRNG Prediction and Timing Attacks in API Tokens

#cybersecurity #javascript #security
Comments
5 min read
XXE in Document-Processing APIs: The Attack Surface Nobody Hardens
rxkov profile
Rxkov

XXE in Document-Processing APIs: The Attack Surface Nobody Hardens

#cybersecurity #infosec #security
Comments
5 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.