Page 21 - Security/OWASP

BOLA and IDOR top the OWASP API Security Top 10 because being logged in does not automatically mean being authorized to access a specific object. We explain how the gap appears, walk through an attack, and lay out a systematic way to audit existing APIs against it.

Storing database passwords or API keys directly in code creates a risk that persists even after deletion, because Git keeps every version permanently. This article shows how Magento teams keep credentials out of code, using env.php patterns, environment variables, dedicated secrets managers like Vault, consistent rotation and automated leak scanning.

Credentials in the environment section of a compose.yaml end up in docker inspect, in process lists and often accidentally in log output. The secrets block in Docker Compose solves this problem by delivering credentials as files inside the container instead of as visible environment variables, creating a significantly cleaner way of handling passwords and API keys.

A CIS Benchmark provides the most concrete checklist available for hardening a Linux server traceably and meeting compliance requirements. Anyone who understands the controls, prioritizes them and automates them with CIS-CAT and Ansible replaces manual one off checks with repeatable, auditable processes.

A Magento production server is only as secure as its least hardened service. This article shows, hands-on, how to systematically shrink the attack surface by disabling unneeded services, automating security updates, enforcing non-root execution, correcting file permissions, running fail2ban, and hardening SSH, with a direct tie-in to the Mark Shust docker-magento setup and typical Debian or Ubuntu production environments.

DNSSEC protects DNS answers with cryptographic signatures against spoofing and cache poisoning, while CAA records define which certificate authorities are even allowed to issue certificates for a domain. We walk through the practical setup for both measures and where each one reaches its limits.

Choosing the wrong authentication method costs more than just security, it costs developer time on every single integration. API keys, bearer tokens, OAuth2 and HMAC signed requests each solve a different problem, and knowing the difference lets you make the right call before the first commit.

rkhunter and chkrootkit compare known rootkit signatures, file permissions, and process lists against a stored reference state of the system. This guide shows how to install both tools, set them up as a recurring baseline check via cron, and correctly interpret a positive finding without creating a false sense of complete detection.

Security reviews rarely fail because of missing knowledge, they fail because of missing routine in day to day pull request practice. This article delivers a concrete checklist for input validation, authorization checks and output encoding, exposes common blind spots in internal and admin only code paths, and explains how manual review and automated tooling complement each other so vulnerabilities surface before the merge, not after the incident.

Image signing proves that a container image actually originates from your own pipeline and has not been altered since the build. A software bill of materials lists every single component inside the image and makes supply chain risks visible before they turn into a security incident. Cosign and Syft from the Sigstore ecosystem implement both without requiring your own PKI infrastructure.