Updated August 22, 2026
Most Express cookie apps still do not need a JWT
Cookie session first. JWT only when a third party must verify the token.
Library
Secure coding notes
How injection still happens, how auth fails, and what actually holds. The archive starts in 2020. Newer guides open with a takeaway, cite first-party pages with a date, and include a prove-it block when the claim is executable.
Updated August 22, 2026
IDOR still starts when the query only asks for the id
Authorize the object, do not trust the id in the URL.
Updated August 22, 2026
Injection still starts when untrusted data reaches an interpreter
Bind parameters. Do not concatenate untrusted input into a query.
Updated August 22, 2026
CSRF still starts when the browser sends a cookie you did not mean
Sec-Fetch-Site first, SameSite as a belt, token for login and old clients.
Updated August 22, 2026
XSS still starts when untrusted HTML reaches the browser
Encode by context, then enforce Trusted Types. The hatch is still innerHTML.
June 28, 2022
Ruby Malware and Prevention Methodology
A comprehensive look at Ruby malware and prevention methods for secure coders.
June 21, 2022
Five Ruby Malware Threats to Be Aware of
A comprehensive look at the leading Ruby malware attacks developers should be aware of.
June 15, 2022
How to Automate Server Hardening
A general view of the server hardening and how to automate it using a variety of different tools.
June 8, 2022
What is the Diffie-Hellman Key Exchange and How Does it Work?
A general view of the Diffie-Hellman Key Exchange cryptography method and how effective it can be for cybersecurity.
June 1, 2022
Server Attack Prevention
A server is essentially a computer (hardware and software) whose function is to store information, provide services, run programs, and more. Only…
May 18, 2022
Zero Trust Model for Effective Security
A general view of the Zero Trust architecture and how effective it can be for cybersecurity in large and small companies.
May 11, 2022
Everything You Need to Know to Understand Credential Stuffing
A detailed discussion on credential stuffing and methods of retaining confidentiality.
May 4, 2022
AWS S3: Is It Really That Secure?
An analysis of security leaks occurring on the AWS S3 server and how to solve the problem.
April 28, 2022
Snort, Intrusion Detection, and Unauthorized Use
A general view of intrusion detection and intrusion prevention softwares with specific examination of Snort and Snort rules.
January 10, 2022
Open Source Solutions for Cybersecurity Log Management
A comprehensive explanation of the evolution of open source solutions for cybersecurity log management, including BSD syslog protocol, IETF syslog…
December 23, 2021
The Use of Playbooks in Vulnerability Management
A comprehensive study on using playbooks and how they impact a business’s cybersecurity.
December 22, 2021
Vulnerabilities in Internet of Things (IoT) Devices
Diving into the role of vulnerabilities in the Internet of Things and the future of IoT devices.
December 13, 2021
Penetration Testing in Flask Application
All you need to know about penetration testing in Flask applications along with a helpful guide to two of the most common pen testing tools for…
December 8, 2021
Using Cryptography for Security in Django App
A tutorial on encrypting data on your Django app to secure it so that it cannot get compromised during an attack.
November 29, 2021
How to Securely Deploy Your Django Application to Heroku
A tutorial for setting up Django, preparing for deployment, setting up a data management service, securing your application and deploying it.
November 22, 2021
How To Guard Django Application Against Cross-Site Scripting
A comprehensive description of different types of cross-site scripting of XSS attacks and ways to fortify your application against them.
November 16, 2021
Code Audit: How to Ensure Compliance for an Application
A detailed explainer on source code auditing, its objectives and advantages, and its methods: dynamic, static, and manual analysis.
November 7, 2021
How to Secure a PHP Based API Using JWT
learn about the JWT tool that helps improve the security of web based communications and how to implement it in your PHP based applications.
November 1, 2021
Serverless Architecture Vulnerabilities and How to Prevent Them
Serverless is becoming commonplace but it also has its vulnerabilities. Here’s what you can do about it.
November 1, 2021
How To Use HTTP Headers To Secure Your Web Applications
Learn how HTTP security headers can protect your web app. How to use HTTP Strict Transport Security, X-Frame-Options, Content Security Policy, & more.
October 21, 2021
How To Secure Your Project With OWASP ZAP
How to secure your project with OWASP ZAP (Zed Attack Proxy) – a tool that lets you test the robustness of your application against vulnerabilities.
October 10, 2021
How Java.Security Works
java.security is a package that provides all the related security-based classes, interfaces, and enums for Java-based applications. Here is a…
September 30, 2021
Is Your Varnish A Ticking Security Vulnerability?
What exactly is an HTTP accelerator? What are the vulnerabilities? and is your current Varnish installation secure?
September 26, 2021
A Guide to Hardening an Ubuntu Based LAMP
How to secure Ubuntu based web server & how to secure an environment for running LAMP based web applications.
September 26, 2021
Ways To Secure Your AWS VPC
Your AWS VPC may not be as secure as you need it to be. Here are some ways to increase the security of your AWS infrastructure.
September 22, 2021
Secure Your Node.js Application With Proper Error Handling
Here is a quick guide on how to secure Node.js application with proper error handling.
September 9, 2021
Securing Mobile Applications in the Cloud
Understanding different cloud models and what steps to take to secure them in order to secure your application
August 29, 2021
Insider Threats: The Frequently Overlooked Cybersecurity Concern
A look the security vulnerabilities that exist within an organization and how they can be neutralized or minimized.
August 22, 2021
Common Hacking Techniques You Should Know About
Some of the common hacking techniques that are used to attack websites and what can be done to prevent them.
August 22, 2021
Input Validation: Client-Side & Server-Side Cybersecurity Deterrent
The value of input validation and how client-side and server-side implementation can make your software significantly more secure.
August 9, 2021
Brute Force and Dictionary Password Attacks – Why You Should Be Concerned about Them?
A comprehensive look at what brute force attacks and dictionary password attacks are and how they can be used by hackers to gain access into accounts.
August 4, 2021
7 PHP Security Resources to Keep on Your Radar
Learn 7 tools that will help you improve the security of your PHP apps with very little effort.
August 1, 2021
How Kotlin is Better Than Java at Solving Long-Standing Security Risks
How and why Kotlin is more secure than Java? What are the security risks that Java faces that Kotlin solves?
July 18, 2021
7 Ways to Enhance Database Security
All you need to know about different ways you can enhance database security for your application.
July 8, 2021
Secure Authentication – Everything You Need to Know
All you need to know about securing the authentication process on web apps, including the different methods of security authentication, how to go…
July 7, 2021
AI and Cybersecurity: a Paradox or a Contradiction?
Artificial intelligence can help enterprises to stay secure, and it can pose a cybersecurity threat. What does this mean for C-suite and developers?
June 27, 2021
Most Common Web Security Vulnerabilities and How to Patch Them
All you need to know about web security vulnerabilities like SQL injection and XSS and how we can avoid them.
June 23, 2021
What is Helmet.js & Why it is a Security Best Practice For Express.js
Express is one of the most popular frameworks for rapid application development in Node.js. But securing your headers can be cumbersome to do….
June 23, 2021
NIST Zero Trust Architecture
All you need to know about zero trust architecture, its components, its network requirements and when and how it should be deployed in your system.
June 17, 2021
Is Serverless Secure?
Serverless is supported by major cloud providers such as AWS, Google Cloud, and Microsoft Azure. But how secure is it? And what can we do to…
June 7, 2021
Fixing the Most Common Security Vulnerabilities in PHP Powered Websites
Learn about common PHP vulnerabilities, the risks associated with them and how you can fix them to keep your web apps secure.
May 31, 2021
Ansible Security Best Practices
Ansible is good for automation. But how secure is your automation? Here are some ways to increase the security of your Ansible module easily.
May 30, 2021
TLS Security: TLS/SSL Explained
What is TLS? Why does it matter? And how do you enable it for your Apache, Tomcat, and Java Spring Boot application? Read more to find out.
May 30, 2021
How To Secure Your JavaScript Backend via Node.js and Express.js
There’s more to it than just using JavaScript. It’s also how you use Express.js and implement security measures in node.js
May 17, 2021
Why You Should Be Performing Continuous Security Testing On Your Systems
Security testing is often the last thought but it should be a first. Here are the reasons why and what you can do about it.
May 3, 2021
Incorporating Security in SDLC
All you need to know about the benefits of including security in your software development life cycle and how to incorporate it.
April 29, 2021
Session Management: An Overview
A quick and comprehensive read on session management, cookies, and best practices to follow in session management.
April 26, 2021
CIS’s Top 20 Controls
Focus on the top 20 controls detailed by the Center for Internet Security that provide the best practice guidelines keeping security of…
April 19, 2021
How To Secure Your Firebase Database with Database Rules
Many devs are working with default rules and struggle to secure their Cloud Firestore databases. Here’s a quick guide on how to effectively secure…
April 12, 2021
Is MongoDB Actually Safe to Use?
A comprehensive introduction to data encryption and database encryption, the difference between the two and methods of encryption.
April 5, 2021
Integrating a Security-First Approach into Your Team
There’s more to a security-first approach than just code. Here’s how to look at security in a cohesive approach rather than just a single entity.
March 31, 2021
IAM Roles and Keeping Your AWS Account Secured
It’s tempting to give admin permissions to your developers, but it is a growing security problem that teams need to understand the repercussions.
March 24, 2021
Data and Database Encryption
A comprehensive introduction to data encryption and database encryption, the difference between the two and methods of encryption.
March 22, 2021
OWASP Secure Coding Checklist
All you need to do to secure your software from security threats as per OWASP.
March 17, 2021
Defense In-Depth (DiD) Strategy
All about the Defence In-Depth (DiD) strategy of system security.
March 15, 2021
Why Refactoring Is Essential To Security
A concise dive into the benefits of refactoring your backend code for robustness and increased security.
March 14, 2021
Is Agile Threatening Code Security?
A quick guide on how to set up AWS code pipelines and how it can benefit your agile processes.
March 1, 2021
Securing Enterprise Networks From Backdoors
Backdoor attacks can be detrimental to your data security. Here’s all you need to know about securing enterprise networks from backdoors.
February 24, 2021
End-to-End Encryption For Data Security
All you need to know to get involved in end-to-end encryption for keeping your data secure.
February 22, 2021
Penetration Testing in Python Like the Pros
Discover advanced tools and books you can use to learn pro-level penetration testing in Python.
February 21, 2021
Don’t Trust Your Users – Data Cleaning in Node.js
A quick look into how you can keep your data clean from vulnerabilities and inconsistencies.
February 10, 2021
How Good Is Angular, Really?
A comprehensive review of Angular as a framework, its special features, and testability.
February 9, 2021
7 Best PyCharm Plugins For 2021
PyCharm plugins make your Python development secure, productive, and enjoyable. Learn about the top 7 best plugins for 2021.
February 8, 2021
Can Functional Programming Protect Your Code Against Vulnerabilities?
How not sharing states, enforcing immutability, preventing side effects, and using declarative methods can help secure your code.
February 3, 2021
What Is Man In The Middle (MitM) Attack
Learn all about MAC layer Man in the Middle attacks on networks.
February 3, 2021
Penetration Testing as a Service: A Practical Guide
Learn what is Penetration Testing as a Service (PTaaS), and what capabilities a cloud-based pentesting delivery platform offers.
January 31, 2021
What is Malicious Code: A Comprehensive Guide
What are the types of malicious code? How can you identify, remove, and prevent it? Learn more about different malware concepts.
January 26, 2021
Penetration Testing Types and Methodologies
Penetration testing types targeting the network, applications, physical security, and more, as well as few distinct approaches to pentesting.
January 21, 2021
Linux Penetration Testing: 4 Great Tools and a Quick Tutorial
Discover linux penetration testing tools such as Kali Linux and BackBox, and get a quick tutorial to get started with penetration testing on Kali.
January 20, 2021
All About Azure Penetration Testing
All about Azure penetration testing: what is the difference between Microsoft’s red and blue teams, and how to conduct penetration testing on your…
January 19, 2021
Penetration Testing Steps: Anatomy of a Successful Pentest
Learn about the 7 penetration steps – scope, reconnaissance, vulnerability assessment, pentest, lateral movement, risk analysis, and pentest report.
January 14, 2021
Best Practices For Flask Security
All about the best practices one should follow to optimize security for the Flask micro-framework.
January 12, 2021
All You Need to Know About Format String Vulnerabilities
All about format string vulnerabilities that continue to be one of the most crucial input vulnerabilities in the Information Security Domain.
January 10, 2021
How to Defend Your Website Against Denial of Service Attacks
Learn about how to defend your website against denial of service attacks – the world’s most common and yet dangerous cybersecurity attack.
January 10, 2021
Integer Overflow Attack and Prevention
All you need to know about the detrimental yet easily-preventable Integer Overflow attack.
January 6, 2021
All About Doki Malware
This is all you need to know about the recently-created Doki Malware and how to defend yourself against it.
January 3, 2021
Get the Best of SOAR Today with Better Security Tools
All about SOAR – a more comprehensive approach to security that ensures nothing falls between the cracks.
December 30, 2020
API Security Testing: Is Your API Really Secure?
Discover four quick API security tests, a detailed API security checklist, and great open source tools you can use to test your APIs.
December 28, 2020
What Does “Good Code” Look Like And How To Achieve It
In this guide, we will go over the ingredients required for writing a good code and how to achieve it.
December 23, 2020
Penetration Testing vs Vulnerability Scanning: How to Choose?
Learn key differences between penetration testing and vulnerability scanning, and which test is best for your organization.
December 21, 2020
How to Protect Against Buffer Overflow Attack
All about buffer overflow attacks, which continue to be one of the most crucial vulnerabilities in the Information Security Domain.
December 14, 2020
Spaghetti Code: A Recipe For Vulnerable Code & How To Fix It
Spaghetti code poses a vulnerable risk to your data and database if not properly secured. Learn what it means and how to fix it.
December 14, 2020
Protecting Your Site From Broken Link Hijacking
Your site’s broken links might be one of your biggest security threats, learn how to get your site protected from broken links hijacking.
December 7, 2020
Preventing Path Traversal
How to prevent the path traversal vulnerability, a web security risk that allows the attacker to read unrecognized files on the application server.
December 6, 2020
Angular and Firebase Authentication Integration
In this tutorial, we will be focusing on implementing Firebase authentication with an Angular application.
November 22, 2020
3 Types of Security Vulnerabilities That Affect Your Code
Three common security vulnerabilities that affect your code. These weaknesses can be potentially exploited and affect your software security.
November 18, 2020
Monitoring JavaScript Files For Bug Bounty
Learn how to monitor and protect your javascript files using bug bounty tools such as Bug-Bounty-Toolz and JSmon by Robre.
November 3, 2020
Accidental Vulnerabilities vs. Malicious Releases
What is the difference between open source accidental vulnerabilities and malicious vulnerabilities, or supply chain attacks, and how to minimize…
October 26, 2020
Top 5 MySQL Vulnerabilities and How to Fix Them
In this article, we are going to explore and and find a fix to the top MySQL vulnerabilities in order to secure our data.
October 19, 2020
React Vulnerabilities Checklist
React has a smaller attack surface than other frameworks, however, this doesn’t mean we should not include security best practices into our…
September 28, 2020
Foundations of Writing Secure Code
To write secure code you need to follow some best practices and use the right toolset. In this article we will be outlining some of the best…
September 14, 2020
Best Python Open Source Security Tools
In this article we explore some of the best Python open-source code scanning, loose type checking, and other security tools.
August 24, 2020
Most Common Security Vulnerabilities Using JavaScript
We dive into common JavaScript vulnerabilities, the risks they pose, and how developers can address these vulnerabilities to keep their web…
July 30, 2020
Secure Coding Done Right.
In this article we put together a list of practices that offer a solid foundation for building more secure applications.
July 27, 2020
Fixing Common Go Vulnerabilities
Go is Google’s programming language released in 2009. It’s a statically typed, compiled and open source programming language. In this article, we…
July 22, 2020
The cost of unsecured code
How & why unsecure code can put intellectual property, consumer trust, business operations, and organizational services at risk, and how to avoid…
July 13, 2020
Best Practices for Docker Security For 2020
In this post, we will dive into the most important things every Docker user should keep in mind to secure their deployments.
July 6, 2020
Understanding and Preventing LDAP Injection
This article will walk you through LDAP injection, a type of attack used to exploit applications that rely on user input to construct LDAP statements.
June 29, 2020
Updating Open Source Dependencies Is a Pain, but Also the Key for Your AppSec
Why open source outdated dependencies have become a huge blind spot for developers & how you can deal with that.
June 8, 2020
How Improper Input Validation Can Lead To xPath Injections
In this article, we dive into the problem of input validation and sanitization, by showing how it serves as a gateway to vulnerabilities such as…
June 1, 2020
Secure Coding Best Practices
Matthew Butler covers the basics of the threat landscape and development best practices.
June 1, 2020
Secure Architecture and Testing Best Practices
Matthew Butler covers the threat landscape and best practices for writing secure code, looking at architecture design choices & testing strategies.
May 25, 2020
Finding and Fixing C++ Vulnerabilities
In this article, we will dive into common C/C++ vulnerabilities, including integer overflows, incorrect type conversion, and string vulnerabilities.
May 18, 2020
Python Security Practices You Should Maintain
In this article, we’ll explore best practices for securing python code from the simplest practices to the hardest one.
May 11, 2020
All you need to know about AngularJS Security
This article is designed to help you develop secure Angular applications. It dives into Angular security best practices that can ensure your…
