Dev.to Security

Security Tip: Two-Factor Authentication — The Extra Lock Every Admin Account Needs

A strong password is a good start, but on its own it is a single point of failure. Passwords leak in…

Building a Private Kubernetes Lab on AWS

For the hands-on side of the Certified Kubernetes Security Specialist (CKS) exam, I wanted a lab whe…

Stop Using chmod 777 for One Extra User: Practical POSIX ACLs on Linux

A deploy user needs to write to one directory owned by a service account. The ticket is two lines lo…

Lazarus Group: the hackers who fund a nation

Most hackers want money. Some want attention. A few want secrets. Lazarus Group wants all three, and…

Is my Supabase database open for anyone to read?

Is my Supabase database open for anyone to read? Is my Supabase database open for anyone to read? …

Apple Sent Spyware Threat Notifications to Users in 99 Countries; Germany Investigates

Originally published on Rohan Tech Official. On October 30, Apple sent a fresh round of threat noti…

Why AI Security Is Essential for Businesses Adopting Generative AI

The rapid adoption of enterprise artificial intelligence is transforming modern business operations.…

Secret Scanners Look for Credentials. I Wanted One That Looks for Me.

I let coding agents write a lot of my commits now. They write what they see, and what they see is my…

How I check whether a "no upload" PDF tool really keeps my file local

Lots of PDF and image sites now say "your file never leaves your device". Some of them mean it, and …

When Postman Installed AI Plugins Without Asking: Why Trust Got Broken

Let’s get straight to the point. Imagine one morning you fire up Postman (for many of us, the go-to …

How I Vet an Open-Source Dependency Before Betting On It

Originally published on my blog — read it there with the full context, code and updates. I was hand…

Node.js Realtime Chat Token Expiry and Explicit Logout Revocation

Short answer: for a marketplace support chat, use short-lived, room-scoped tokens as the damage limi…