标签：#Security

When I first got interested in cybersecurity, I thought it was all about tools. Nmap, Metasploit, Wireshark, Burp Suite. I downloaded them all, watched tutorials, and felt like a hacker. But the first time I tried to customize a scan or parse a weird log file, I hit a wall. I didn't know how to code. And in cybersecurity, that's like trying to be a chef without knowing how to use a knife. This article is for people who want to move beyond clicking buttons. Whether you're a beginner deciding where to start or a security analyst who wants to automate boring tasks, programming will change how you work. I'll cover why programming matters, what languages to learn, the concepts you'll actually use, projects to build, and how to think like both an attacker and a defender. Why programming isn't optional anymore Cybersecurity used to be more forgiving. You could run a vulnerability scanner, read the report, and call it a day. But threats have gotten more complex, and so have the defenses. Today, you need to: · Write scripts to analyze thousands of log lines in seconds. · Automate repetitive tasks like phishing email analysis or IP reputation checks. · Understand the code behind vulnerabilities so you can explain them to developers. · Build custom tools when existing ones don't fit your environment. · Test your own code for flaws before attackers find them. If you can't read or write code, you're limited to what someone else built. That's not a career; that's a hobby. Programming gives you the ability to solve problems no tool can solve out of the box. What "programming for cybersecurity" actually means It's not software engineering. You don't need to build a full web application or master design patterns. Instead, you use code as a tool for investigation, automation, and exploitation (ethically, of course). Different roles need different levels of programming: · SOC analysts might write Python scripts to correlate logs or query APIs. · Penetration testers write proof-of-conc

The hacks at shipping companies used to mail out hardware wallets puts crypto owners at greater risk of real-world attacks.

When a vendor is breached, don't wait for their update page: figure out fast what that vendor can see or touch inside your business, and act on that answer before you have all the facts. Vendor breaches are a recurring headline: a phone system, messaging platform, or file-sharing tool used by thousands of businesses discloses an incident, and every customer of that vendor suddenly has to ask what it means for them, usually with almost no visibility into the vendor's internal investigation. The gap between "something happened to our vendor" and "here's what we do about it" is where most companies lose time they can't get back. Quick answers What's the first thing to do when a vendor is breached? Confirm exactly what that vendor can access in your systems — before you do anything else. Should I rotate credentials before the vendor confirms exposure? Yes, for anything plausibly exposed — even though it may briefly disrupt a live integration. How often should I re-check a slow-to-disclose vendor? It depends on how much access they hold — high-privilege vendors need a 48–72 hour check-in, not a week. Do I need a written plan before an incident happens? Yes — a one-page plan per privileged vendor, reviewed at least yearly. Why vetting a vendor once isn't enough Most businesses do vendor due diligence at signup: a security questionnaire, maybe a look at their trust page, a checkbox before the contract is signed. That's reasonable, but it only answers the question that matters on day one: is this vendor safe to start using? It doesn't answer the question that matters every day after: if this vendor gets breached, what happens to us, and what do we do? Vetting is a point-in-time filter. A breach is an ongoing event with a timeline, and your response needs its own plan, separate from the vetting checklist you ran before signing. The fix is simple: treat vendor risk as a lifecycle, not a gate. Vet before you sign, revisit access and exposure on a regular cadence, and have a re

By: Pierre Le Clezio, Lead Product Manager – GitGuardian; Nic Gumina, Senior Security Consultant – AWS; Manu Chandrasekhar, Senior DevOps Consultant – AWS; Dan Parlin, Security Consultant – AWS This article was originally published at AWS blogs . The rise of AI coding assistants and Model Context Protocol (MCP) servers has accelerated the secret management challenge as developers increasingly share configuration files and context with AI tools that inadvertently expose sensitive credentials. API keys, access tokens, and credentials end up in Git repositories and CI/CD logs. Organizations lack answers to critical questions. They don't know which vaulted secrets have been exposed in code, whether developers have shared credentials through AI tool configurations, how many duplicate credentials exist across accounts, or how many orphaned secrets remain that no application uses. The visibility gap leads to: Credential exposure : Hardcoded secrets in version control systems create attack vectors that persist even after rotation Secret sprawl : Duplicate credentials across accounts expand your attack surface Compliance gaps : Inability to track secret lifecycles undermines audit requirements Remediation delays : Without correlation between secret inventory and code exposure, security teams lack the context to prioritize and act quickly With multi-account AWS architectures, the need for unified visibility becomes critical. Organizations need more than just a vault. They need visibility across the entire secret lifecycle, from developer workstations to production environments. GitGuardian and AWS Secrets Manager GitGuardian is an AWS Partner specializing in non-human identity (NHI) security, which focuses on protecting machine credentials such as API keys, service accounts, tokens, and secrets management. GitGuardian can be integrated with code repositories, container registries, package registries, documentation platforms, and messaging channels. GitGuardian's integration w

What kind of data is being collected by our devices, and how is it being used? Should we "Ask app not to track"?

Hard-coding credentials, API keys, or access tokens in automated test suites is one of the most common security risks in software engineering. Ensuring that sensitive variables remain isolated across local developer environments and CI/CD pipelines is critical for keeping your code repositories secure. Here is a practical guide and best-practices workflow for managing secrets cleanly in test automation frameworks. Core Recommendations for Secure Test Suites Zero Source Control Leakage: Always add .env and .env.local files to your .gitignore. Never commit raw tokens or passcodes to git. Use Managed CI Secret Stores : In build pipelines, leverage platform native secret managers such as GitHub Secrets, Harness Secrets, Azure Key Vault, AWS Secrets Manager, or HashiCorp Vault. Dynamic Injection via Environment Variables: Read sensitive data dynamically inside tests using standard environment variables (e.g., process.env.API_KEY or process.env.API_BASE_URL). Enforce Least Privilege: Scope test credentials strictly to non-production environments and configure them to expire periodically. Implementation Examples Local Development Usage: Create a non-committed local environment file (.env.local): API_BASE_URL = https://staging.example.com/api API_TOKEN = your_secret_token_here Execute your test suite while passing or overriding variables inline: # Setting environment variables directly before execution $env :API_BASE_URL = 'https://staging.example.com/api' npm run test :api CI Pipeline Integration (e.g., GitHub Actions): Store API_TOKEN under your repository's Settings > Secrets and variables > Actions, then pass it into your execution job step: - name : Run API Tests run : npm run test:api env : API_TOKEN : ${{ secrets.API_TOKEN }} API_BASE_URL : ${{ secrets.API_BASE_URL }}

A two-factor flag in the user store looks like a reassuring authorization check. It tells us the account has a second factor configured. For a sensitive operation, however, that is only half the question. The other half is about the session in front of us: did this cookie actually complete a second-factor challenge? Those facts can change independently. Treating them as interchangeable can silently promote an old password-only session after the account enables MFA. Two questions that look like one Account capability answers questions such as: Is a factor enrolled now? Could the account complete an MFA challenge? Has that capability since been disabled? Session assurance answers different questions: Which authentication steps produced this session? Did the framework issue this cookie after an MFA challenge? Is the evidence trusted, or merely a user-supplied claim? An enrolled account can still have a password-only session. A previously verified session can also outlive a later change to the account’s factor state. One signal cannot safely stand in for both. The transition that exposes the gap Snapshot tests often miss this because the final state looks correct. The account has MFA enabled, the user is authenticated, and a policy succeeds. Now test the transition instead: Sign in with a password and receive a normal application cookie. Enable MFA for the account without replacing that cookie. Use the original cookie against a sensitive operation. If authorization checks only the current enrolment flag, step three may succeed. Nothing about the original authentication ceremony changed, but the session has effectively been upgraded by a later database write. That is the important boundary: changing account capability must not rewrite the history of an already-issued session. Use two independent signals A generalized policy can be expressed like this: if (! session . IsAuthenticated || ! session . HasTrustedMfaEvidence ) return Deny ; if (! await accountStore . IsMfaStil

AI is reshaping cybersecurity for attackers and defenders alike. Learn how OpenAI is strengthening its defenses and what security teams can do now.

A delete button is easy to ship. Real deletion is much harder. That gap matters more with AI agents than with normal apps because one user action can scatter data across prompts, traces, memory stores, vector indexes, tool logs, temporary files, model gateways, retry queues, and analytics events. If your product only deletes the visible chat row, the user may be gone from the UI while their data still lives in five backend systems. For AI app builders, this is not just a compliance chore. It is a trust feature. Users will forgive slow answers faster than they forgive a system that says “deleted” but keeps enough context to reconstruct the conversation later. This guide shows how to design an AI agent data deletion pipeline that removes user data for real, proves what happened, and avoids breaking production workflows while doing it. Why AI deletion is different Traditional deletion usually starts with a known record: a user, a project, a file, a message, or a row in a database. AI agents create a messier shape. A single agent run may include: raw user prompt rewritten prompt retrieved documents embeddings cached model input tool arguments tool responses browser snapshots screenshots uploaded files generated artifacts chain-of-thought-like internal notes you should not store memory summaries trace logs billing metadata support debug events queue state approval comments eval replay packets Some of those records are user-visible. Many are not. That is why “delete the chat” is not enough. Agent deletion needs a map of every place where user data can land, plus a workflow that deletes, redacts, or tombstones each location according to its risk and legal retention rules. The failure mode: UI deletion without backend deletion The dangerous pattern looks like this: The user clicks delete. The app removes the conversation from the sidebar. The backend keeps traces, embeddings, prompts, and tool logs for debugging. A restored pointer, support export, analytics query, or vecto

According to the Financial Times, OpenAI disbanded its preparedness team at the end of last month. The job of the preparedness team was to assess if models posed serious risks and develop ways to mitigate those risks. (You know, like the possibility that it could go rogue and hack another company.) According to FT, responsibility […]

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry. A quick note...

I just shipped a referral system for Adsyte , my free directory for indie projects, and the design decision behind it is worth sharing because it's a pattern that applies to any growth loop with a token reward attached. The obvious version, and why it's broken The naive implementation: give the recruiter tokens the moment someone signs up through their link. Simple, but it has an exploit built in. Signing up costs nothing, and OAuth makes throwaway accounts trivial. Anyone can self-refer through five Discord accounts and walk away with free reward tokens without bringing a single real user to the platform. What I did instead The payout only fires when the recruit publishes their first listing, not when they sign up. This one change closes the loop: A fake account costs nothing, but a real listing needs an actual project with a real URL The listing already has to pass duplicate-URL detection and hCaptcha, so faking one is meaningfully harder than faking a signup Every token paid out corresponds to a listing the directory actually gained, which is the metric that matters, not signups Implementation notes Referral code is an HMAC of the user's id, derived deterministically rather than stored as a random token, so there's nothing extra to generate or leak The code lives in a cookie set on landing ( ?ref=CODE ), read once at OAuth callback, and tied to the account via a Redis SETNX so it can only ever be set once, self-referral excluded outright Payout uses SETNX again on a per-recruit key so double-firing (retries, race conditions) can't double-pay A daily cap per recruiter stops a single compromised or bot-driven account from draining the reward pool in one sitting Nothing here is novel, it's the standard "pay for the outcome, not the action" principle, but I don't see it applied to referral systems as often as it should be. Most implementations I've seen reward signup because it's the easy event to hook into, and then bolt on fraud detection after the abuse shows up.

Building software in 2026 feels surreal. With LLMs handling boilerplate, we ship features in hours that used to take weeks. But fast shipping has a nasty side effect: it breeds overconfidence. A few days ago, we ran an automated check against our own live marketing site ( vergate.dev ). We build security and diagnostic tools for a living, so we expected a clean bill of health. We were wrong. Our scanner flagged 8 real issues in production—including missing security headers that left us exposed to basic cross-site attacks. Dogfooding your own tool isn't a marketing gimmick. Sometimes, it's just plain embarrassing. But it taught us a crucial lesson: you can’t fix what you don't automatically measure. What our scan actually found Here is the exact breakdown of what slipped past us into production (and what probably exists in your current deployment right now): 1. Zero Security Headers Enabled Our hosting provider’s default CDN edge rules didn't set baseline headers. We were shipping without: Content-Security-Policy (CSP): Left us open to inline script injection. Strict-Transport-Security (HSTS): Didn't force browsers to enforce HTTPS strictly. X-Content-Type-Options : Allowed MIME-type sniffing on static assets. X-Frame-Options : Rendered our pages vulnerable to clickjacking IFrames. Why this happens: Framework defaults (like Next.js, Nuxt, or Astro) often expect your proxy or CDN edge (Vercel, Cloudflare, Nginx) to handle headers. If you forget to configure the edge, your app runs bare. 2. Sensitive Meta & Server Leakage Our response headers explicitly broadcast our server stack and proxy details. Attackers use automated scanners like Shodan or Censys to query these specific signatures and exploit target-specific CVEs in seconds. 3. Cookie Missing SameSite & Secure Flags A tracking cookie set on a subroute wasn't explicitly flagged as SameSite=Lax or HttpOnly , leaving a window open for CSRF-style cross-domain requests. How we fixed it (in under 10 minutes) Fixing the

✓ Human-authored analysis; AI used for formatting and proofreading. Kelsey Hightower gave a talk at PlatformCon 2026 that was about the arc of a career, from running commands in SharePoint to writing Go tools that play music on your terminal. The stories has an architecture principle that applies to how security verification should work. Solve the problem once, encode the solution as a reusable artifact, and never solve that problem again. The Jira loop He joined a company where deployments were driven by Jira tickets. Someone opens a ticket with deployment parameters. An engineer would read the ticket, copy the parameters, run the commands, paste the output back into the ticket, close it, and wait for the next one. Every hour, another ticket. Same process, commands and manual steps. The engineer became the loop. He wrote a Puppet manifest that watches the tickets, extracts the parameters, runs the deployment, posts the output, and closes the ticket. The loop ran once as automation and then it was over. No engineer in the loop or ticket waiting for a human. The problem was solved, permanently, by encoding the solution into a reusable artifact. Doing a repetitive manual process faster is not the right thing to do. Eliminate the loop by recognizing the abstraction hiding in the repetition and encoding it into an artifact that makes the manual steps unnecessary. The substrate This is the pattern that runs through every transition he describes. It's missed by most people when they talk about automation. System administrators ran deploy.sh manually. Docker didn't automate typing apt-get install . Docker recognized that "application + dependencies + environment" was a repeatable unit. The container image became the substrate. Deployment stopped being a sequence of commands and became a declaration. The commands didn't get faster. They became unnecessary. Operators placed workloads on servers manually. Kubernetes didn't automate SSH-ing into machines to check available mem

You deleted the row. The secret is gone from the app, the queries return nothing, and the dashboard is clean. In SQLite — the database behind most session stores, browser profiles, and agent state files — that delete is a fiction. The bytes are still in the file. Three ways deleted data survives 1. Free pages. SQLite doesn't zero out the space a deleted row occupied. The page is marked free and added to the freelist; the old bytes stay until they're overwritten by a future write. A file that's been deleted-from is a forensics goldmine: recover the freelist pages and the "deleted" rows come back. 2. FTS virtual tables. If the database uses SQLite's full-text search (FTS5), the FTS index keeps its own copies of the indexed text, maintained separately from the source tables. Delete the row from the source table and the FTS index still contains the tokens — searchable. This is the one that catches people: their app shows the secret is gone, and the FTS index still has it. 3. WAL and journal files. In WAL mode, recent writes live in the -wal file; transactions in the -journal file. Both can retain pre-delete content until checkpointed or cleaned. "Deleted" in SQLite means "no longer referenced", not "no longer present". What erasure actually requires Making a secret physically disappear from a SQLite database takes three operations, in order: Replace the value everywhere it lives. Known secret values get replaced across all tables; pattern matches (API key formats) get masked. Two layers, because you can't enumerate every secret that leaked. Rebuild the FTS indexes. INSERT INTO t(t) VALUES('rebuild') style rebuilds, or drop/recreate the virtual tables — so the index no longer contains the old tokens. Run VACUUM. VACUUM rewrites the entire database file, copying only live data into a fresh file — free pages with old bytes are discarded in the process. After VACUUM, the file's raw bytes no longer contain the secret. (Note: VACUUM doesn't shrink WAL files; those need a chec

This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more on AI safety, follow Robert Hart. The Stepback arrives in our subscribers' inboxes at 8AM ET. Opt in for The Stepback here. How it started It all started in July, when one of OpenAI's autonomous AI agents […]

Passkeys are still safer than passwords. That is the answer, and the research behind the scary headlines says so too. On 3 August 2026, Palo Alto Networks' Unit 42 published three techniques that let malware take over accounts protected by Google-synced passkeys. No fingerprint, no PIN, and no prompt on screen. The coverage that followed skipped the part readers need: exactly who is exposed, and what to change. The real scope is narrow. The fix is cheap. The standard itself is not broken. What Pass-ta-key actually is A passkey is a key pair that replaces a password. The private half stays on your device or in a synced store, and the site only ever sees a signature. Unit 42 named three variants, not four. Several outlets reported a fourth, including 9to5Google . The research describes three ( Unit 42 , 3 August 2026). Pass-ta-key. Malware extracts Chrome's device identity key and uses it to sign a request. No admin rights, no device unlock, no user action. Silver Pass-ta-key. The attacker forces Chrome to re-register the device. They then register their own user-verification key with Google's cloud authenticator. Afterwards they can sign in from their own machine, and the cloud authenticator believes a fingerprint check happened. Golden Pass-ta-key. The attacker pulls the Security Domain Secret out of Chrome's process memory during onboarding. The Security Domain Secret is a 32-byte master key that protects every synced passkey. With it, they all decrypt. This is the variant that turns one infection into a saleable bundle ( BleepingComputer , 3 August 2026). The target is not the passkey file on disk. It is the Google Cloud Authenticator behind Google Password Manager, and the trust it puts in a device that malware is now imitating ( The Hacker News , August 2026). Who is actually affected This is the question the coverage left open. Here it is against the research's own stated scope. Setup Status Chrome on Windows with a TPM, Google Password Manager Affected. This i

A Reddit thread on connecting Claude Code to a Yahoo Mail account turned into a solid field guide for scoping down what an AI agent is allowed to touch. Here's the distilled version. Don't give Claude Code your Yahoo password or unrestricted mailbox access. The risk isn't only the password leaking, it's that an agent with full access can read private messages, attachments, recovery details, and information about other people, all in the course of doing something mundane. Why "just connect it" is the wrong instinct The thread's most-quoted line frames the problem well: people are casually handing agents the keys to everything at once. People are talking about just giving ai agents access to their entire devices LOL. Emails, passwords, bank accounts like what. The concern isn't that the agent will maliciously steal your data, it's that broad access creates exposure you didn't intend, every time the agent reads something to complete an unrelated task. The issue isnt really theft its exposure. And exposure scales with trust you've already granted, not with anything going wrong: It's all based on trust. Safer ways to connect it 1. OAuth over password Use a connection method where Yahoo shows you exactly what's being requested and lets you revoke it later. Never type your Yahoo login directly into the agent. 2. Least access, read-only Point it at a separate, low-value mailbox if you can. Avoid granting send, delete, forward, or account-settings permissions; the agent shouldn't be able to act as you. 3. Keep credentials out of the agent The safer pattern is a credential vault the agent calls out to, so it can request an authenticated action without ever seeing the raw secret. Before you connect anything ✅ Strip sensitive mail first. One commenter's habit: swap real details for placeholders and dummy data, then substitute the real values back in once the model's output comes back. ✅ Use a throwaway or secondary account. Never connect the address tied to banking, password re

Access tokens, refresh token rotation, and theft detection: the parts most Node.js tutorials leave out. A friend messaged me about his side project a few months ago: "Someone else is logged into my account. I changed my password. They're still in." He had followed the tutorials to the letter. Sign a JWT on login, send it to the frontend, keep it in localStorage , attach it to every request. Done. What none of those tutorials mentioned is that this setup has no way to un -log anyone in. A JWT is a signed piece of paper. Once you hand it over, it stays valid until it expires, and his expired in 30 days. Changing the password accomplished nothing, because the token had already been signed and nothing about it depended on the password. There was no list of active sessions to delete from. There was nothing to revoke. His only remaining move was rotating the signing secret, which logged out every user on the platform at once. That was his entire kill switch: burn it all down. This is the walkthrough I wish someone had handed me the first time I built auth. Token design, storage, refresh rotation, theft detection, the Express code, the Axios interceptor on the frontend, and the specific mistakes that turn a working login into an incident. It's long. Auth is one of those areas where the missing ten percent is the part that gets you. What the standard tutorial leaves out Nearly every "JWT authentication in Node.js" post ends in the same place: sign a token, put it in localStorage , send a Bearer header. That gets you a demo. Four things stand between that and production. localStorage is readable by any JavaScript on the page. That includes the analytics snippet you added last week, the npm package that got compromised upstream, and any XSS hole in your own code. One call to localStorage.getItem('token') and an attacker holds a working credential they can replay from their own machine. You can't detect it and you can't stop it. There is no revocation. The appeal of JWTs is st

Your threat model has a hole shaped like your house. You run endpoint protection on your Mac. You have 2FA, passkeys, hardened browser, DNS filtering. You would never install random software from a forum. Then you walk into your living room that has 14 always-on microphones, 6 cameras, 3 devices that map your floor plan, and a router you have never audited, all running firmware you have never read. We need to talk. In cybersec we threat model laptops. We never threat model apartments. That is backwards. Your laptop leaves your house. Your house never leaves. If your home is compromised, every device you bring into it is compromised by proximity. Here is how I started threat modeling my apartment the same way I threat model my infra. It takes an afternoon and it will make your home actually sovereign. Step 1: Draw Trust Zones, Not Floor Plans Stop thinking in rooms. Start thinking in trust zones, exactly like network segmentation. I use 3 zones: Zone 0: The Dead Room. One room where no device can listen, watch, or transmit. No smart anything. No WiFi. No Bluetooth. This is where you think, talk for real, and store sensitive hardware. My bedroom is Zone 0. Nothing with a mic crosses the door. It has a mechanical door sweep and a faraday pouch for phones. Zone 1: The Clean Network. Your own network that you control. Your router, your Pi-hole, your own hotspot. Devices you have audited. This is where your work laptop lives. It never touches landlord WiFi, coffee shop WiFi, or that free "Apartment_5G" that is actually a $30 camera streaming 24/7. Zone 2: The Dirty Periphery. Everything else. Landlord's smart lock, smart thermostat, package room cameras, your smart TV, robot vacuum, Alexa, LED strips with mics, that random air freshener that is plugged in at waist height. Assume Zone 2 is hostile and logs everything. Most people live entirely in Zone 2 and call it cozy. That is why they get doxxed by their own house. If you want the full build for a Zone 0 room, what to r