· 6 min read
Security
Supply-Chain Attacks: Auditing Your DependenciesYour app is mostly code you didn't write. How dependency supply-chain attacks happen and a practical playbook for auditing what you ship.
Read article· 6 min read
Security
AppSec for builders: auth, secrets, supply chain, and the vulnerabilities that actually bite production systems.
5 articles
Supply-Chain Attacks: Auditing Your Dependencies· 6 min read
Security
Secrets in Environment Variables: The Leaks You Don't SeeEnv vars feel like the safe place for API keys and passwords. Here are the quiet ways they leak — and how to keep secrets out of sight.
Read article· 6 min read
· 6 min read
Security
SQL Injection Still Works in 2026 — Here's Why, and How to Stop ItSQL injection is decades old and still breaching databases. Why it survives modern frameworks, and the parameterized patterns that kill it.
Read article· 6 min read
· 5 min read
Security
JWTs: Stop Storing Them in localStorageWhy localStorage is the wrong home for your JWTs, how XSS turns it into a token vault for attackers, and what to do instead.
Read article· 5 min read
· 5 min read
SecurityA post-mortem on a broken access control bug that exposed other users' data — what went wrong, how we caught it, and how to prevent it.
Read article· 5 min read