Dev.to Security

Lorex IP Camera Network Architecture: Subnets, Port Maps, and Web Login Runbook

Deploying IP security cameras and Network Video Recorders (NVRs) requires proper Layer 2 and Layer 3…

A thirty-day assurance loop for PHP2Shell remediation

A thirty-day assurance loop for PHP2Shell remediation An emergency patch can be complete on the da…

SPF "too many DNS lookups": how to fix the 10-lookup limit

Your SPF record looks fine and your mail provider says everything is configured, yet DMARC fails and…

Why Modifying a Signed PDF Breaks Digital Signatures (and How Incremental Updates Work)

If you build document workflows, electronic signature tools, or legal intake pipelines, you have pro…

Replace reCAPTCHA: the checks before you switch

Switching bot checks is mostly an inventory job: where the service is placed, where your server chec…

PerimeterX _px3: the two expiries that kill your cookie (and the s2s path that has none)

PerimeterX (today HUMAN Security) does not ask your scraper a question at request time. It hands out…

Trivy vs Amazon Inspector: Container Image Scanning on AWS, Explained

You push a container image to Amazon ECR. Is it safe to run? There are two common ways to answer th…

BOSSAI: One Attacker's AI Agents Pulled Taipei 119 Dispatch Records and Exposed Patient Data

TL;DR what: A single Taiwan-based attacker used BOSSAI, a 12-agent AI setup running mostly on sa…

Mobile App Security Checklist 2026 (Banking & Fintech)

Short answer: a banking app security checklist should follow the OWASP MASVS v2 control groups: STOR…

8 hops from a license plate to an unlocked car door

8 hops from a license plate to an unlocked car door Two researchers turned a license plate into a …

How to keep API keys out of AI-generated code

Practical checklist from ShipSafeStack. Not a penetration test, compliance audit, score, or proof th…

Your escrow buyer only needs a wallet, not an account

The buyer in an agent-to-agent deal is rarely your user. It is another company's agent, or a person …