DEV Community

Security

Hopefully not just an afterthought!

Posts

đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.
Rate Limiting Fails in Production Because It Counts the Wrong Dimension
rxkov profile
Rxkov

Rate Limiting Fails in Production Because It Counts the Wrong Dimension

#authentication #cybersecurity #production #security
Comments
6 min read
API Tokens in CI/CD Pipelines: Five Exposure Surfaces That Rotation Does Not Close
rxkov profile
Rxkov

API Tokens in CI/CD Pipelines: Five Exposure Surfaces That Rotation Does Not Close

#api #cicd #devops #security
Comments
5 min read
gRPC Security: The Authorization Model REST Scanners Cannot See
rxkov profile
Rxkov

gRPC Security: The Authorization Model REST Scanners Cannot See

#api #backend #cybersecurity #security
Comments
5 min read
GraphQL Security: Introspection, Injection, and Authorization
rxkov profile
Rxkov

GraphQL Security: Introspection, Injection, and Authorization

#osint #security
Comments
7 min read
API Versioning: When /api/v1/ Survives Without the Authentication Added in /api/v2/
rxkov profile
Rxkov

API Versioning: When /api/v1/ Survives Without the Authentication Added in /api/v2/

#api #backend #cybersecurity #security
Comments
5 min read
REST API File Upload Attack Chains: MIME Bypass, Path Traversal, and SVG-to-XSS
rxkov profile
Rxkov

REST API File Upload Attack Chains: MIME Bypass, Path Traversal, and SVG-to-XSS

#api #backend #cybersecurity #security
Comments
6 min read
BFLA Survives Pentests: Why Testers Never Try the Wrong HTTP Method
rxkov profile
Rxkov

BFLA Survives Pentests: Why Testers Never Try the Wrong HTTP Method

#api #cybersecurity #security #testing
Comments
5 min read
JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It
rxkov profile
Rxkov

JWT Key Reference Injection: The Attack Class That Wins Bounties While Guides Miss It

#authentication #cybersecurity #infosec #security
Comments
5 min read
MCP Tool Schema Poisoning: When the Framework Layer Authorizes the Attack
rxkov profile
Rxkov

MCP Tool Schema Poisoning: When the Framework Layer Authorizes the Attack

#cybersecurity #llm #mcp #security
Comments
6 min read
LLM Covert Channels: How AI Agents Exfiltrate Data in Plain Sight
rxkov profile
Rxkov

LLM Covert Channels: How AI Agents Exfiltrate Data in Plain Sight

#ai #cybersecurity #llm #security
Comments
5 min read
The OAuth Implicit Flow Is Deprecated, But Your Access Tokens Are Still Leaking
rxkov profile
Rxkov

The OAuth Implicit Flow Is Deprecated, But Your Access Tokens Are Still Leaking

#authentication #cybersecurity #javascript #security
Comments
4 min read
Mobile Certificate Pinning Bypassed in 60 Seconds: What Frida Reveals About the Real Threat Model
rxkov profile
Rxkov

Mobile Certificate Pinning Bypassed in 60 Seconds: What Frida Reveals About the Real Threat Model

#android #cybersecurity #mobile #security
Comments
5 min read
Non-Constant-Time Comparison Turns Every API Token into a Character-by-Character Oracle
rxkov profile
Rxkov

Non-Constant-Time Comparison Turns Every API Token into a Character-by-Character Oracle

#api #backend #cybersecurity #security
Comments
5 min read
AI Agent Tool-Chaining: When Individually Permitted Calls Compose Into Unauthorized Capability
rxkov profile
Rxkov

AI Agent Tool-Chaining: When Individually Permitted Calls Compose Into Unauthorized Capability

#agents #ai #cybersecurity #security
Comments
4 min read
Prompt Caching Is a Timing Oracle: How the 41-80% Cost Win Becomes Cross-Tenant System Prompt Extraction
rxkov profile
Rxkov

Prompt Caching Is a Timing Oracle: How the 41-80% Cost Win Becomes Cross-Tenant System Prompt Extraction

#api #cybersecurity #llm #security
Comments
4 min read
đź‘‹ Sign in for the ability to sort posts by relevant, latest, or top.