Page 20 - Security/OWASP

A fixed path like /tmp/script.tmp in a shell script is an open invitation for race conditions, data leaks, and symlink attacks. mktemp guarantees unique, safe temporary files, and trap EXIT ensures they get cleaned up in every termination scenario.

A GraphQL API that works in development mode is not yet a production-ready API. Performance traps, security gaps and missing observability only surface under load, exactly when there is little room to react. This checklist closes those gaps before they become a problem.

A penetration test uncovers real attack paths that automated scanners miss, but it requires written permission upfront, a clear scope, and a team that actually acts on the results. This article explains testing approaches, authorization requirements, how development teams prepare, and the difference between an internal security review and hiring external pentesters, illustrated with concrete practical examples.

Linux capabilities split the traditional root privilege into more than forty individual bits, so a process gets exactly one right, for example binding a privileged port, without inheriting everything else that comes with root. That is the difference between a least privilege design and a server that instantly loses full root access whenever a single compromised service goes wrong.

The Magento backend under the default path /admin is one of the most frequently automated scanning targets of every store on the internet. With a custom admin path, mandatory Two-Factor Authentication, consistent IP allowlisting at the webserver level, short session timeouts, and a regular account and role audit, you close the most common entry points before automated attacks and credential stuffing attempts ever get a chance.

A cookie banner that lets tracking scripts keep running while the user has not yet consented satisfies neither ePrivacy nor GDPR nor TTDSG. This article shows how opt-in consent works granularly per purpose, how scripts get technically blocked until consent is given, how Google Consent Mode v2 and CMP platforms are correctly integrated, and how to actually verify your own implementation in the network tab.

Solid PCI-DSS hardening requires concrete Linux configuration, not just process documentation. Understanding which requirements of the standard apply directly to the server allows implementing firewall segmentation, access control, logging and file integrity in a way that holds up to a Qualified Security Assessor.

Docker Scout is an analysis tool built into Docker Desktop and the Docker CLI that surfaces CVEs in images, gives recommendations for leaner base images, and fits into the daily workflow without installing a separate tool.

A publicly reachable GraphQL endpoint that accepts arbitrary mutations is an open door for data manipulation, spam, and automated attacks. GraphQL persisted mutations close this gap by only allowing execution of a server-side pre-approved list of operations, everything else gets rejected before a single resolver ever runs.

A .env file with plaintext passwords inside the deployment artifact is a security risk many Symfony teams silently accept. Vault management with HashiCorp Vault replaces static secrets with dynamic, short lived credentials that rotate automatically and are logged without gaps. This article shows how Symfony is connected to Vault in practice.