4276 articles
4276 ARTICLES
Using a programmable SQL interface such as an ORM (Object Relational Mapping) is a good way to reduce risk of SQL Injection, which is a very bad vulnerability to have. However, ORM packages are not bullet proof. This post explains why you shouldn’t put all your SQL Injection protection eggs in the ORM basket, and what more can you do.
A quick look at the different options for getting Node.js vulnerability alerts, based on the based on the RSS feed of Snyk’s Vulnerability DB.
Learn how Relay uses connections, edges, and nodes to model relationships and pagination on top of GraphQL schemas.
A recently published vulnerability in the npm marked package shows how attackers can use the flexibility of the Markdown format to introduce Cross-Site Scripting vulnerabilities. This post explains the issue and the fix, and discusses the difficulty of sanitizing complex user input.
With AWS Lambda, your code is automatically scaled to meet requests. This kind of direct computing is on a trajectory of voracious expansion.
Snyk now provides a free service that lets anyone test for vulnerabilities in – and then monitor – any public Node.js GitHub repository.
In this post, we explain how the “Buffer” class works, and why it behaves the way it does. We’ll run an exploit against a vulnerable application, to better demonstrate the ramifications.
Last week, CERT alerted users to the risk of publishing or consuming a malicious npm package. This important risk is not unique to npm, but it is more likely to happen in this ecosystem. This post explains the risk and how you can protect yourself.
A little over 3 years ago, a few friends and I started a group called pasten to participate in the Chaos Computer Club’s Capture The Flag (CTF) competition. It is a jeopardy style CTF, where the participating teams need to solve security related challenges in various categories such as exploitation, reverse engineering, web, forensic & crypto.
Leaking credentials means exposing secrets that provide access to different accounts. The most common types of leaked credentials are passwords, API keys and SSH private keys. In this post, we discuss best practices you can establish as part of your flow to introduce multiple layers of defense that help prevent mistakes.