Security
Your dependencies are your attack surface: a supply-chain security checklist
Most of the code you ship, you didn't write. A short, practical checklist for keeping third-party packages from becoming your next incident.
Topic
Security
Vulnerabilities, supply-chain safety and secure-by-default engineering.
Security
SQL injection is still here. Parameterized queries still fix it
One of the oldest web vulnerabilities keeps showing up in new code. The fix has been known for decades — here's how to apply it everywhere, including the places ORMs don't cover.
Security
Storing passwords safely: slow hashes, salts and what not to do
If your user table leaks, how you hashed passwords decides whether attackers get a list of emails or a list of working logins.
Security
CSRF in the age of SameSite cookies
Browsers now block many cross-site requests by default. That helps, but it doesn't make CSRF tokens obsolete.
Security
Content Security Policy without breaking your site
CSP is one of the most effective defenses against cross-site scripting. Rolling it out gradually is the difference between protection and a broken checkout page.
Security
Secrets management for small teams
API keys in the repo, passwords in chat, one shared admin login. A practical path from secret sprawl to something you can actually audit and rotate.
Security
Rate limiting algorithms: token bucket, fixed window and sliding window
Rate limits protect logins from brute force and APIs from overload. The algorithm you choose decides how bursty traffic is treated.
Security
Threat modeling for small teams in an afternoon
You don't need a security department to think like an attacker. A lightweight, repeatable session finds the risks worth fixing before they ship.
Security
Signing commits and build artifacts: proving where code came from
Anyone can set their git author name to yours. Signatures let you verify who actually made a commit, and which pipeline produced a release.