Cybersecurity

Finding Exposed APIs and Services: A Practical Guide for Developers

As developers, we often build and deploy services, APIs, and applications that interact with the int…

"A Secret-Less Trial Workspace Needs Canary Credentials and Egress Proof"

A trial workspace asks for repository access, package downloads, and perhaps a deployment token. Sta…

JWT + OAuth2 + OIDC + PKCE Complete small Guide

The flow will be: Authentication foundation Session vs JWT JWT deep dive JWT security Access/Refre…

Enterprise Authentication with AWS Blocks

_Note: AWS Blocks is currently in preview and the API is subject to change. _ A login form is not a…

Password Entropy Explained: Why Length Beats Complexity in Modern Auth

For years, password policies enforced arbitrary complexity rules: at least one uppercase letter, one…

v1.2.2 finally shipped Sensitive Data Warning. It took four versions to get right.

Six weeks ago I started adding a warning that fires before the user sends a prompt containing email,…

Building a Secure Password Generator in JavaScript: A Practical Guide

Password breaches happen every year, and weak passwords are the low-hanging fruit for attackers. …

Moving SSH Clients to macOS? Test SFTP After Reconnecting

While building DartShell on macOS, I ran into a migration issue that a successful SSH login did not …

Should You Sign Out of OpenAI? The Hugging Face Breach Explained

You open ChatGPT to ask a harmless question, then see a headline saying an OpenAI model escaped its …

How to Secure Your Short Links

How to Secure Your Short Links: Password Protection and Expiration Short links are convenient, but…

Link Shorteners for Financial Services Security and Compliance

Link Shorteners for Financial Services Security and Compliance Financial institutions face unique …

Advanced Link Management: Password Protection, Expiration & More

Advanced Link Management: Password Protection, Expiration & More Beyond basic URL shortening, adva…