Dev.to Security

Pillow will open your avatar.png as a Photoshop file

I saved a Photoshop document, renamed it avatar.png, and posted it to a Django form that only accept…

How I built a DSC PDF signer in Rust and Tauri

I'm a company director, and in India that means signing board resolutions and financial statements w…

Building Verity Protocol: Infrastructure for Digital Media Provenance

Detection tools analyze files after manipulation, creating probabilities instead of definitive proof…

TVL Trend Analysis & Liquidity Risk Assessment: Robinhood

TVL Trend Analysis & Liquidity Risk Assessment: Robinhood Target Protocol: Robinhood (TVL: $14456.…

PHP 8.5.12 RCE Patch: The Checklist I Run on Every Server

I was halfway through a coffee yesterday evening when the PHP security advisory landed in my feed, a…

I audited my own Supabase project and found it wide open — with RLS on

I ran a security audit on my own Supabase project last week. RLS was enabled. Three policies per tab…

The Mosaic Leak Hiding in Agent RAG

USC's Information Sciences Institute published a paper on arXiv (2610.30418) looking at what happens…

Large-File Avatar Uploads with Presigned Storage and Explicit Deletion Deadlines

Large-file avatar uploads are easiest to operate when the application server authorizes a short-live…

Check identity, tenant and tool permissions before an MCP call

An MCP server exposes capabilities to a client. It does not make every tool call authorized merely b…

The DMARC Record a Small Business Should Publish First (and When to Tighten It)

If your business sends mail from its own domain ([email protected]), three DNS records do the aut…

Cross-Site Request Forgery (CSRF): When Your Browser Becomes the Attacker

Imagine logging into your banking application, then opening another website in a different tab. Wit…

Refresh tokens in a .NET 10 Minimal API: rotation, reuse detection and revocation

In the previous posts of this series I've been building a free .NET 10 Minimal API starter: JWT auth…