Skip to content
Subscribe

Notes

A publication on secure coding for the software we all ship.

Free notes on XSS, auth, and injection, and the defenses that still hold after the framework defaults. Not a vendor pitch.

Browse all articles
Popular topics: XSS Input validation CSRF IDOR TLS More
SecureCoding ship at a harbor with a lighthouse, crane, and cargo marked with code, lock, and shield.
Cookie slot still life for the CSRF guide
#CSRF

CSRF still starts when the browser sends a cookie you did not mean

SameSite=Lax withholds a foreign POST. A top-level GET and a sibling host still send the cookie. Then Sec-Fetch-Site allow or 403.
Ink blot still life for the XSS guide
#XSS

XSS still starts when untrusted HTML reaches the browser

textContent encodes characters. innerHTML parses tags. Trusted Types throw on a plain string.

 Numbered drawer still life for the IDOR guide
#IDOR

IDOR still starts when the query only asks for the id

Authorize the object. WHERE id=? is not ownership.

Latest notes

View all articles
Cookie jar still life for the JWT guide
#JWT

Most Express cookie apps still do not need a JWT

Cookie session first. JWT only when a third party must verify the token.

 Recipe card still life for the injection guide
#Injection

Injection still starts when untrusted data reaches an interpreter

Bind parameters. Do not concatenate untrusted input into a query.

 Coat check still life for cookie sessions
#Sessions

Cookie sessions in 2026: __Host-, Lax, and regenerate

Four belts on one cookie. __Host- refuses Domain.

 Glass tunnel still life for TLS
#TLS

TLS 1.3, 200-day certs, and HSTS are the 2026 bar

Default is TLSRef Intermediate: 1.2 and 1.3. Not 1.3-only.

 Sealed crate still life for Docker
#Docker

Docker in 2026: non-root USER, read-only rootfs, pin tags

USER 10001, –read-only plus tmpfs, FROM by digest.

 Key pile still life for credential stuffing
#Stuffing

Credential stuffing in 2026: MFA, rate limit, HIBP

A stolen list dies at the login door, not after a session exists.

On the desk