MSManuel Spigoloninbackend.cafe·2h ago · 9 min readHow we are securing the Fastify organizationSome time ago I was asked a very simple question about Fastify: who can publish it? I knew the shape of the answer, a handful of people I trust. What I did not have was the list with the actual set of00
DJDevy Jonesindevyjones.hashnode.dev·4h ago · 5 min readFinding Exposed APIs and Services: A Developer's Guide with ScanSearchAs developers, we're constantly building and deploying services. While we focus on functionality and user experience, it's equally critical to understand the external attack surface our applications p00
DTDavid Timothyindigitalunpacked.hashnode.dev·7h ago · 8 min readWhy GrapheneOS Is the Best Android OS for Privacy and SecurityI have used stock Android for years. Pixel, Samsung, you name it. I thought it was "clean" and "secure" because Google told me so. Then I actually looked under the hood as a developer and realized how00
JGJoe Gellatlyinmedcurity.hashnode.dev·11h ago · 4 min readIf You're a Healthcare Vendor, a Signed BAA Is the Start of Your HIPAA Job, Not the EndIf your company handles protected health information for healthcare clients, you are a business associate, and your clients are starting to ask a harder question than "will you sign a BAA?" They want 00
ARAI Robot Supplierinairobotsupplierresearch.hashnode.dev·14h ago · 4 min readTwo High-Severity Unitree G1 EDU Vulnerabilities: What Robotics Developers Should KnowHumanoid robots are increasingly becoming network-connected computing platforms with cameras, wireless interfaces, AI accelerators, sensors and physical actuators. That makes cybersecurity an increasi00
JKJaydeep Kanzariyainjaydeepkanzariya.hashnode.dev·1d ago · 13 min readOAuth 2.0 doesn't log anyone in — that's OIDC's jobHere's a "Login with Google" endpoint. It's the shape a lot of tutorials teach, and it will hand a session cookie to an attacker. // ❌ src/routes/auth.js — accepts an access token as proof of identity00
JLJeremy Longshoreinjeremylongshore.hashnode.dev·20h ago · 12 min readA Path Is Not Proof of IdentityFive marketplace submissions rejected simultaneously for the same security defect class. Every one created local state under the default umask, checked permissions with [[ -f ]], then wrote to the nam00
Bbolt_utilinbolt-util.hashnode.dev·21h ago · 7 min readDesigning a Safe Reconciliation System for Underpaid Crypto TransactionsA crypto payment does not become easy to reconcile just because it is visible on-chain. Consider a customer who creates an order for 1.01 USDT and transfers 1.00 USDT. The transaction is valid and con00
JLJeremy Longshoreinjeremylongshore.hashnode.dev·22h ago · 12 min readA Path Is Not Proof of IdentityFive marketplace submissions rejected simultaneously for the same security defect class. Every one created local state under the default umask, checked permissions with [[ -f ]], then wrote to the nam00
AJAmartya Jhainsecurity-research.hashnode.dev·22h ago · 10 min readHow a GitHub Triage Role Hijacked an Already-Authorized Claude Code Action RunHackerOne #3918594 · Claude Code Action v1.0.185, commit 9db594c7a0e82298c121c18b7f08aa1579ce7341 · CVSS 4.0 score 7.5, High Authorizing an automated job is really two promises: who gets to start it,00
