Actionable security insights: safeguarding cloud infrastructure, writing secure code, and navigating enterprise compliance.
Exploring the axios npm supply chain attack reveals a concerning story: a fake startup founder, a hijacked maintainer account, malware hidden in a popular JavaScript library, and a challenging 3-hour cleanup. It highlights the importance of vigilance in the open-source community.
Read full dispatch
Here's a helpful guide to essential authentication and authorization practices for your web apps and APIs, covering passwordless login, multi-factor authentication, password hashing, RBAC, and ABAC. These tips are designed to keep your applications secure and user-friendly.
Read full dispatch
OAuth 2.0 is a common authorization framework that lets you grant applications limited access to your online accounts without sharing your passwords. Learn the roles, grant types, and steps.
Read full dispatch
Sometimes you need to authenticate your app with a third-party authentication server while still using the features Firebase provides. Here is how to create and use a custom token to do exactly that.
Read full dispatch
Learn how to secure Firebase HTTPS Cloud Functions using Firebase Authentication. Validate Bearer ID tokens with Express middleware and the Admin SDK to allow only authenticated users.
Read full dispatch
Learn how to use Google dorks and the Google Hacking Database to find vulnerabilities on your own web servers before attackers do. All you need is a browser.
Read full dispatch