Application Security for Developers
Secure code is
readable code.
Deep-dive guides on SQL injection, JWT attacks, supply chain security, and more. Code-forward. No fluff.
Featured
ChainDrop: How a Preinstall Hook Turned keyv and cacheable Into a Self-Propagating npm Worm
ChainDrop compromised keyv, cacheable, and 450+ downstream npm packages via a malicious preinstall hook. Here's how the worm propagated, what it stole, and how to lock down your install pipeline.
npm 12's allowScripts: Turning Install Scripts Into an Explicit Allowlist
npm 12 disables preinstall/install/postinstall lifecycle scripts, git dependencies, and remote tarballs by default. Here's how the new allowScripts allowlist works, how to migrate without breaking CI, and why it directly blocks the ChainDrop-style worm pattern.
SQL Injection Prevention: A Complete Developer Guide
Parameterised queries, ORM pitfalls, and blind SQLi detection patterns to protect your application data.
Cross-Site Scripting (XSS): Prevention Patterns for Modern Web Apps
Reflected, stored, and DOM-based XSS explained with real exploit chains and prevention patterns for JavaScript, React, Node.js, and Python.