Security Briefings
Source-reviewed guidance for security tooling, browser-local workflows, and practical engineering decisions.
CVE-2026-59208: n8n Token Exchange Cross-Issuer Account Confusion
How CVE-2026-59208 let a valid JWT from one trusted issuer resolve to an account under another issuer, which versions are affected, and how to remediate it.
OAuth Token Leakage in CI/CD: Prevention and Response
Reduce CI/CD token exposure with short-lived workload identity, least privilege, safe logs, pinned actions, and a tested revocation plan.
HTTP Request Smuggling in API Gateways: Prevention and Testing
Understand HTTP request smuggling, assess proxy-to-origin parsing boundaries, patch Jetty and Axios advisories, and test safely in an authorized environment.
Mass Assignment in APIs: Prevent Unsafe Object Binding
Learn how mass assignment lets clients modify unintended object properties, how it maps to OWASP API3:2023, and how explicit schemas and authorization prevent it.
Vercel Context.ai Incident: OAuth App Governance Lessons
What Vercel confirmed about the April 2026 Context.ai incident, plus a practical process for reviewing OAuth grants, consent, and response.
AI Agent Credential Security: Keeping Secrets Out of Coding-Agent Context
How a local MCP server and a PreToolUse hook keep .env files out of a coding agent's context, what the hook cannot catch, and a credential checklist to run before granting an agent access.
JWT Signing: Safe Token Issuance and Validation
A source-reviewed guide to JWT signing, algorithm selection, claim validation, key separation, rotation, and safe test-token generation.
CVE-2026-33143: OneUptime Webhook Signature Verification
What CVE-2026-33143 affected in OneUptime, how the fix changes the webhook trust boundary, and how to validate and test signed webhook handlers safely.
Hash Generator Guide: SHA-256, Password Hashing, and Verification
Learn what SHA-256 and other hashes can prove, how to verify a digest safely, and why passwords need Argon2id, scrypt, bcrypt, or PBKDF2 instead.
CVE-2026-35616: FortiClient EMS Patch and Response Guide
FortiClient EMS 7.4.5 and 7.4.6 are affected by actively exploited CVE-2026-35616. Check the fixed versions, hotfix paths, and response steps.
Are Environment Variables Secure? A Practical Secrets Management Guide
Environment variables keep secrets out of source code, but they are not a secret manager. Learn where they leak and how to protect .env files, CI/CD, containers, and production credentials.
Secure Coding Practices: What They Are and a Checklist by Development Stage
Secure coding practices are the habits that keep code enforcing its security rules when input is hostile or a component fails. Nine practices with code patterns, sources, and a design-to-deploy checklist.
NIST SP 800-63B-4 Password Rules, and How to Calculate Passphrase Entropy
What NIST SP 800-63B-4 requires for password length, composition, rotation, blocklists and pasting, with section numbers, the entropy formulas for random characters and words, and a review of the OpsecForge Password Generator.
Hash Collision Attacks: MD5, SHA-1, and Safe Verification
Understand hash collisions, why MD5 and SHA-1 are unsafe for signatures, and how to verify files with SHA-256 and an authenticated source.
Environment Variable Leaks: How Secrets Escape and What to Do
Exposed a .env file or environment variable? Revoke real credentials first, investigate where they escaped, remove reachable copies, and fix the leak path.
Broken Object Level Authorization (BOLA): Prevention and Testing
Learn how BOLA occurs in REST and GraphQL APIs, why authentication and unpredictable IDs are insufficient, and how to enforce and test object-level authorization.
JWT Vulnerabilities: Algorithm Confusion, Weak Secrets, and Safe Validation
Understand HS256 JWT vulnerabilities, algorithm confusion, weak signing secrets, missing claim checks, token disclosure, and the validation rules that prevent them.
API Key Leaks: Detection, Response, and Prevention
Learn where API keys leak, how to respond without delaying revocation, and how restrictions, secret scanning, short-lived credentials, and least privilege reduce risk.
AI API Provider Exit Planning: Security and Resilience
Build an evidence-based exit plan for AI API providers: inventory dependencies and data flows, contain outages, migrate safely, and revoke access.
CVE-2026-29000: pac4j-jwt Authentication Bypass and Fix
CVE-2026-29000 affects encrypted JWT processing in pac4j-jwt. Check the affected versions, upgrade paths, exposure conditions, and safe validation steps.
GraphQL Batching and Resource Limits: A Defensive Guide
Bound GraphQL batching, aliases, depth, pagination, and query cost without confusing one HTTP request with one unit of work.
API Inventory and Gateway Boundaries: Finding Endpoints Your Gateway Does Not Cover
How to build an evidence-based API inventory, reconcile it against traffic, and close the routes that bypass your gateway, with a runnable reconciliation script and sourced examples.
How to Generate a UUID v4 in Your Browser
Generate RFC 9562 UUID v4 identifiers with browser Web Crypto, understand their collision probability, and learn when UUIDs are—and are not—the right choice.
How to Sanitize .env Files Before Sharing: A Developer's Guide
Prepare a minimal .env example for AI, support, or a bug report. Try a browser-local redaction walkthrough, review missed values, and learn what to do after a leak.
OAuth Redirect Abuse: Detection and Defensive Controls
How OAuth error redirects can carry users from trusted identity-provider URLs to phishing or malware pages, with role-specific detection and mitigation guidance.
API Rate Limit Bypass: Layered Defensive Controls
Design API rate limits that resist distributed and identity-shifting abuse without treating IP addresses, fingerprints, or one counter as proof of identity.
SQL Injection in API Code: What Parameterized Queries Cover and Where They Stop
Parameterized queries stop value injection, but not dynamic identifiers, ORM raw-query misuse, second-order injection, or LIKE wildcards. Tested SQLite, Django, SQLAlchemy and Sequelize examples.
Why Your API JSON Responses Are a Security Blind Spot
Learn how excessive JSON response fields expose sensitive data, how this differs from request-side mass assignment, and how to test explicit response contracts.
Base64 vs Base64URL: Differences, Padding and Use Cases
Base64URL swaps + and / for - and _ so data fits in URLs, and often drops = padding. RFC 4648 differences, JWT use and when to pick each.
SSRF Prevention for APIs: Allowlist the Host, Check the IP You Connect To
How to stop server-side request forgery in URL-fetching API features: host allowlists, IP checks at connection time, redirect handling, and cloud metadata hardening, with Python and Node code tested against local servers.
How to Verify Webhook Signatures (HMAC-SHA256): GitHub, Stripe and Slack
Verify GitHub, Stripe and Slack webhook signatures with HMAC-SHA256: raw body handling, constant-time comparison, replay windows, event-ID deduplication, working Node and Python code, and a table of why verification fails.