Notes
A publication on secure coding for the software we all ship.
Free notes on XSS, auth, and injection, and the defenses that still hold after the framework defaults. Not a vendor pitch.
Explore our categories
All categoriesSecurity Operations
See the event, decide if it matters, act before the queue buries it.
5 shortlistsApplication Security
The bug is still in the code you ship.
4 shortlistsIdentity and Access
Who is in the token, and can you kill the session.
3 shortlistsCloud Security
The account, not the VM.
3 shortlistsAPI Security
The contract you shipped, not the happy example.
2 shortlistsAI Security
The model, the tool, and the agent. Not the SOC copilot.
2 shortlistsEndpoint Security
The laptop, the phone, the agent.
2 shortlistsWeb Security
The edge: WAF, bot, the request you did not want.
2 shortlistsCryptography
The library you actually link.
2 shortlistsData Security
Where the row lives, and who can select it.
2 shortlistsEmail Security
The inbox and the domain that must refuse the lookalike.
2 shortlistsGRC and Compliance
Evidence, not the control.
2 shortlistsNetwork Security
The path, the resolver, the app you open instead of a flat VPN.
2 shortlistsSupply Chain
What you installed, not what you wrote.
2 shortlistsVulnerability and exposure
What the internet already sees, and the ticket you already have.
2 shortlistsPrivacy
A person asked. Find the row and record the choice.
1 shortlistOT and IoT
A protocol the laptop agent cannot take.
2 shortlistsPlatform security
The factory that ships the workload.
Latest notes
View all articles
JWT in Express: skip it for cookie sessions (2026)
Cookie session first. JWT only when a third party must verify the token.
Injection attacks: the ORM is not a guarantee (2026)
Bind parameters. Do not concatenate untrusted input into a query.
Session management: __Host- cookies, Lax, and regenerate
Four belts on one cookie. __Host- refuses Domain.
TLS security: 1.3, 200-day certs, and HSTS (2026)
Default is TLSRef Intermediate: 1.2 and 1.3. Not 1.3-only.
Docker security: non-root USER, read-only rootfs, pin tags
USER 10001, –read-only plus tmpfs, FROM by digest.
Credential stuffing: MFA, rate limit, and HIBP (2026)
A stolen list dies at the login door, not after a session exists.
