· 7 min read
IDOR and Broken Access Control: A Practical Guide
How IDOR and broken access control creep into REST, GraphQL and Next.js route handlers, how to test for them, and the fixes that hold up in real codebases.
- Security
- OWASP
- Access Control
Security
Guides on code security, AI code review and shipping fixes that hold.
· 7 min read
JWT and Session Security Pitfalls, and How to Avoid Them
The JWT and session mistakes that lead to account takeover: algorithm confusion, weak secrets, missing claim checks, token storage, rotation and real logout.
- Authentication
- JWT
- Security
· 7 min read
Leaked Secrets in Git History: Find, Rotate, Prevent
Deleting a committed API key does not remove it from git history. How to find leaked secrets, rotate them first, rewrite history safely and stop the next leak.
- Security
- Git
- Secrets
· 8 min read
Next.js App Router Security Checklist
A practical security checklist for Next.js App Router apps: server actions, route handlers, middleware, env vars, CSRF, headers, webhooks and per-user caching.
- Next.js
- Security
- Checklist
· 8 min read
Prompt Injection and LLM App Security: A Practical Guide
How prompt injection, tool abuse and link-based data exfiltration actually hit LLM features, and the controls that limit the damage when a model gets steered.
- AI
- LLM
- Security
· 7 min read
Race Conditions and TOCTOU Bugs in Web Applications
How double-spends, coupon reuse and limit bypasses happen when requests race, and how to fix them with constraints, atomic updates, locks and idempotency keys.
- Concurrency
- Databases
- Security
· 7 min read
Security Headers Explained: CSP, HSTS and the Rest
A practical guide to CSP with nonces and strict-dynamic, HSTS and preload, frame-ancestors, Referrer-Policy, Permissions-Policy and COOP, with a Next.js config.
- Security
- Web
- Next.js
· 7 min read
Preventing SQL Injection in Node.js, Python and Go
Vulnerable and fixed SQL snippets for pg, Prisma, psycopg, SQLAlchemy and Go database/sql, plus safe dynamic ORDER BY clauses and IN lists. Mapped to CWE-89.
- Security
- SQL
- OWASP
· 7 min read
SSRF Defense for Webhooks, Link Previews and URL Fetchers
How SSRF turns webhooks, link previews and importers into a path to cloud metadata and internal services, and the defenses that hold, with a Node.js example.
- Security
- SSRF
- Node.js
· 9 min read
Top 10 Code Vulnerabilities to Hunt For in 2026
A practical checklist of the ten vulnerability classes worth checking in every code review, mapped to OWASP Top 10 and CWE, with the one-line fix for each.
- Security
- OWASP
- Checklist
· 5 min read
What a CWE ID Tells You About a Bug
CWE identifiers turn a vague security finding into a precise, trackable class of weakness. A short guide to reading them and using them to prioritize fixes.
- CWE
- Security
- Basics