Dev.to Security

Email Change Flows Need Replay Boundaries

When a product lets users change their email address, the flow often looks harmless. Send a link, cl…

Detecting iCloud Private Relay (and Not Treating It Like a VPN)

Your fraud stack sees a request from an IP it doesn't recognize, tags it anonymous, and quietly bump…

Signing API Requests with HMAC (React Native)

HMAC request signing proves two things to your backend: the caller knows a shared secret, and the re…

CVE-2026-59864: CVE-2026-59864: Critical Out-of-Package Local File Inclusion in Microsoft Kiota

CVE-2026-59864: Critical Out-of-Package Local File Inclusion in Microsoft Kiota Vulnerability ID:…

Link Management for Healthcare: Secure Patient Communication

Link Management for Healthcare: Secure Patient Communication Healthcare providers handle sensitive…

System Guide: Setting Up a Centralized Software Licensing Server

Having visibility into user access and seat distribution is crucial for businesses of all sizes, and…

Block Bots Before They Hit Your API; IP Reputation in Node.js

Most API abuse gets caught after it lands. A rate limiter trips, an alert fires, someone checks the …

Reading an Audit Contest Scope Like an Auditor: Invariants First, Code Second

The first time I audited seriously, I opened the biggest contract in the repo and started reading li…

Understanding OpenID SSO For Secure Authentication

-s-740ee0b7.webp alt: An Introduction to OpenID Single Sign-On (SSO) - Security Boulevard …

Cloud Security for Engineers: The Controls You Actually Configure

TL;DR: Most cloud breaches aren't sophisticated, they're misconfigurations. The controls that actual…

I Audited 50 GitHub Repos - Here Are the 3 Security Mistakes Everyone Makes

I Audited 50 GitHub Repos — Here Are the 3 Security Mistakes Everyone Makes After scanning 50+ ope…

Securely Open Unraid Server Ports for External Access to Matrix and Nextcloud

Understanding Port Forwarding and Security Risks Port forwarding maps incoming network traffic fro…