Security

Supply chain attacks are malicious updates that sneak into open source code used by many apps. Here’s how we design Obsidian to ensure that the app is a secure and private environment for your thoughts.

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. The specification supports Software Bill of Materials (SBOM), Software-as-a-Service Bill of Materials (SaaSBOM), Hardware Bill of Materials (HBOM), Operations Bill of Materials (OBOM), Vulnerability Disclosure Reports (VDR), and Vulnerability Exploitability eXchange (VEX).

Recent npm security incidents reveal fundamental flaws in package manager design. Here's how every package manager should implement security measures to prevent supply chain attacks and protect developers.

Comprehensive cybersecurity guides and strategies for ethical hacking and penetration testing

A typo exposed a hidden supply chain flaw in the JVM ecosystem. What followed was a multi-year battle to track it, patch it, and burn it out of existence.

In order for your app to communicate with the Airship API it must use a key and secret combination that authenticates it to your Airship app setup.

On December 30th, while most of us were preparing for a New Year’s Eve celebration, the US Treasury was prepping a notice to lawmakers to notify them that their systems, which (obviously) contain highly sensitive, confidential data, had been compromised.

An error as small as a single flipped memory bit is all it takes to expose a private key.

Google dork cheatsheet. GitHub Gist: instantly share code, notes, and snippets.

A list to stay safe from NPM supply chain attacks

Suppose I type this in my browser https://www.mysite.com/getsecret?username=alice&password=mysecret and an attacker is watching all traffic from me to my ISP. What information is protected by

Canada Computer's website allegedly had malware that collected payment information dating back to early December, according to customers.

When your account gets hacked, the attack probably came from a Fortune 500 data center. A report on why cloud providers don't stop attacks they could easily detect. - CERBERUS-REPORT-profitable...

We found vulnerabilities in the FIA's Driver Categorisation platform, allowing us to access PII and password hashes of any racing driver with a categorisation rating.

One exposed S3 bucket cost $4.2M discover what makes cloud security attacks so deadly and how to stop them cold.

Two CI/CD vulnerabilities in the nodejs/node GitHub repository exposed Node.js to remote code execution on Jenkins agents and the potential to merge unreviewed code to the main branch of the repository.

A collection of challenge based hack-a-thons including student guide, coach guide, lecture presentations, sample/instructional code and templates. Please visit the What The Hack website at: https:...

We have discovered a critical vulnerability in the Model Context Protocol (MCP) that allows for

By Daniel Heinen

How does your browser know a website is legit? This post simplifies TLS, certificate validation, and the trust chain behind secure connections

Website with the collection of all the cheat sheets of the project.

Common Weakness Enumeration (CWE) is a list of software and hardware weaknesses.

Website with the collection of all the cheat sheets of the project.

Question : What is the maximum number of characters an email address can have?

Here we go through some of the essential protocols required for robust API security.

We go through the fundamentals of API security, including best practices and key considerations for developers and businesses.