Dev.to Security

A PDF dictionary is not necessarily an action

Liquid syntax error: 'raw' tag was never closed…

A PDF action can keep its type and still change behavior

Liquid syntax error: 'raw' tag was never closed…

The Fastest Way to Buy Verified Nextdoor Accounts

Buy Verified Nextdoor Accounts – Account Security, Privacy Protection & Responsible Community Manage…

AI Guardrails in Action: 4 Experiments You Can Run

I wrote a post that does what most guardrail articles don't — shows the actual before/after model ou…

Bring Your Own Keys, Safely: The BYOK Security Model Behind ModelPlane

Bring Your Own Keys, Safely: The BYOK Security Model Behind ModelPlane If you're building on top o…

How to Detect Cross-Tenant Data Leakage in MCP Servers and Multi-Tenant SaaS

The Hidden Security Gap in Multi-Tenant MCP Servers When you build a multi-tenant SaaS application…

GHSA-2RP4-X2J7-QMCC: GHSA-2RP4-X2J7-QMCC: Stored Cross-Site Scripting via Draft Names in Craft CMS Control Panel

GHSA-2RP4-X2J7-QMCC: Stored Cross-Site Scripting via Draft Names in Craft CMS Control Panel Vulne…

Canaries, Not Faith: Auditing Where Your Coding Agent Actually Writes

When people discuss AI agents escaping their boundaries, the mental image is usually dramatic: a jai…

What a Malicious Ollama Model Can Actually Do to Your Host, and How to Sandbox /api/pull

A malicious Ollama model is not a virus you double click, but it is untrusted input handed to a C pa…

Put a Capability Broker Between Your Agent and Its Tools

Agent incidents rarely look like a movie villain. They look like a helpful assistant combining two p…

Don't Trust-Execute AI-Generated Code: A Sandbox Harness for Evaluating Coding Models Safely

In my last post I shared a reproducible harness for comparing free hosted coding models against a lo…

Capturing Your First Web Request with Wireshark on Windows

A live packet capture in Wireshark, filtered down to a single request and response, so you can see e…