Page 18 - Security/OWASP

eval in Bash takes a concatenated string and evaluates it a second time as a shell command, and that is exactly the problem: any unvalidated input flowing into that string can inject arbitrary commands. This article walks through concrete attack scenarios involving eval and introduces safe alternatives such as arrays, namerefs, and printf minus v, which achieve the same dynamism without command injection.

A classic firewall filters network traffic by IP address and port, but never sees what's actually inside an HTTP request. A Web Application Firewall inspects exactly that content and detects attack patterns such as SQL injection or cross-site scripting. This article explains the difference, covers rule types, false-positive tuning, and practical configuration basics for ModSecurity and cloud WAFs like Cloudflare or AWS WAF.

A usage policy for Claude Code is worthless if no one can prove whether it is being followed. Auditing AI tool usage requires an audit trail that documents where AI generated code was created in the project, who reviewed it, and how this evidence can be presented during an internal review or a customer audit.

Anyone using Claude Code or similar assistants sends code context and prompts to an external vendor. This article shows concretely what gets transmitted, how to evaluate a data-handling and training-opt-out policy before adoption, and how to reliably exclude credentials and customer data from the AI context.

GDPR demands far more from development teams than a privacy policy. Data minimization in the database schema, a right to erasure that actually works across backups and third parties, and the ability to report within 72 hours exactly which data was affected are concrete engineering tasks. This article shows how to implement these requirements in code and in Magento architecture.

A Docker image is only as secure as its base image and the system packages installed inside it, and that is exactly where many vulnerabilities hide that neither SAST nor Dependency Scanning catch, since both focus on application code and language packages. GitLab's Container Scanning closes this gap by checking the fully built image directly in the pipeline against a vulnerability database. This article covers the integration, the difference to a standalone tool like Trivy, and how the results end up in the merge request widget.

A container that runs as root, with every Linux capability and a writable filesystem, is technically speaking a privileged process behind a thin namespace curtain. Docker offers several complementary security layers: a non-root USER, minimal capabilities, a read-only filesystem, and seccomp profiles. This article shows how these layers work and how to implement them in real Dockerfiles and Compose configurations.

Building SQL queries through string concatenation opens one of the oldest and still one of the most dangerous vulnerability classes in web development. PDO prepared statements structurally separate code from data and rule out SQL injection regardless of what the input contains, provided they are configured correctly and applied properly to identifiers, LIKE patterns and IN lists. This article walks through the full technical implementation with PDO in PHP 8.4.

Not every file a container writes should outlive the container's lifecycle, especially when it comes to decrypted secrets, session tokens, or temporary encryption keys. tmpfs mounts keep such data exclusively in memory, so it never gets written to the host's disk, making them a simple yet effective security tool for Docker containers.

Unlimited APIs are an open door for abuse, scraping and accidental overload caused by misbehaving clients. This article explains how fixed window, sliding window and token bucket algorithms work, how to configure sensible rate limits per IP address or API key and how gateway layer and application logic can be combined in Magento environments with Redis to keep systems stable and fair.