Writing on web security

Lockfile injection lets an attacker change a resolved download URL in your lockfile so an install pulls malicious code while the manifest…

Build provenance is signed, verifiable proof of where an artifact came from. Learn what it is, why supply chain security needs it,…

How npm lifecycle scripts like preinstall and postinstall let a dependency run code the moment you install it, plus the defenses that…

A typosquatting attack registers a package name one keystroke off a popular one so a mistyped install runs malicious code. Learn how…

Self-hosted runner security in plain terms: why a persistent CI runner is risky, how one job poisons the next, and how to…

Secrets in git history stay exposed after you delete them, because git keeps every old version. Learn why, and how to rotate,…

A Kubernetes RBAC misconfiguration hands a small workload broad cluster access. Learn how wildcards, default accounts, and loose bindings go wrong.

Terraform security starts in the code. Learn the common infrastructure as code mistakes, from open ports to public storage, and how to…

IAM privilege escalation is when a low privilege cloud identity walks a path of allowed actions to admin. Learn the classic shapes…

An S3 bucket misconfiguration exposes private data through open policies. Learn the common mistakes and the exact fixes for each one.