Page 4 - Security/OWASP

JavaScript Numbers are 64-bit floats, and they silently lose precision for integers above 9 quadrillion (2^53). BigInt solves the problem: arbitrarily large integers without rounding errors, for IDs, cryptography, timestamps and financial calculations.

Passwords in Dockerfiles, API keys as ENV variables, certificates baked into image layers: these are real security holes in thousands of container setups. Docker Secrets, BuildKit mount secrets, and well-designed credentials management eliminate these risks without slowing down the development workflow.

A Content Security Policy drastically reduces the risk of cross site scripting, yet many PHP applications either skip it entirely or copy a rigid policy straight from a tutorial. Generating the policy directly from PHP, with per request nonces and a controlled rollout through report only mode, gives you a protection mechanism that fits the application instead of blocking it.

API versioning is usually viewed as a pure compatibility problem, but it carries substantial security implications that often get overlooked in practice: every older API version kept running in parallel enlarges the entire application's attack surface, and a security fix implemented only in the current version leaves all older, still-reachable versions vulnerable. Attackers know this and deliberately search for old API versions that have fallen out of the development team's active maintenance focus but remain technically reachable.

With server-side request forgery, an attacker tricks a server into making requests on their behalf against internal resources, such as cloud metadata endpoints or internal admin panels. We cover the typical entry points and how to validate target URLs with an allowlist instead of a blocklist.

Anyone connecting via SSH to the same server ten or twenty times in a row inside a deployment script pays the full price of a TCP handshake, key exchange and authentication every single time. ControlMaster shares a single established SSH connection over a local Unix socket with every further call, making Bash automation noticeably faster.

Vue.js protects against most XSS attacks out of the box, until developers reach for v-html, innerHTML or unsanitized API data. A Vue security review reveals where these safeguards get bypassed and how to treat third-party dependencies and a missing CSP as additional attack vectors.

Image scanning checks every layer of a Docker image against databases of known vulnerabilities before a container even starts. Trivy and Grype are the two most widely used open source scanners for this, but they differ enough in database sources, speed, and extra features like SBOM generation and IaC checking to make the choice worth thinking through.

Feeding unchecked user input into shell_exec, exec, or system hands attackers the keys to full control over your server. This article shows how command injection arises in PHP applications, where escapeshellarg and escapeshellcmd genuinely help and where they fall short, and why native PHP libraries and the Symfony Process component are the most robust fix.

GitLab protected and masked variables are the standard way to use secrets in a pipeline, but they remain static, long-lived values that can circulate unchanged for months in the worst case. HashiCorp Vault takes a different route through the native GitLab CI integration: credentials are issued only when the pipeline runs, are short-lived, and expire automatically. This article shows how the integration works technically, what it gains over plain protected variables, and when the extra operational effort actually pays off for a Magento project.