Page 5 - Security/OWASP

Volume encryption only protects data against a stolen hard drive, not against a compromised database account reading data normally through SQL. Column-level data encryption closes exactly this gap, but demands careful decisions around key management, searchability, and indexing that blanket volume encryption never has to make.

An expired TLS certificate is one of the few failures that can take a shop completely offline without a single code bug behind it. Monitoring TLS certificate expiry with Bash and openssl catches looming outages weeks in advance and prevents the midnight emergency call.

Filenames with spaces, tabs, newlines, and non-printable characters exist on every system. Most shell scripts handle them incorrectly, resulting in silent data corruption, failed operations, or even security problems. Null delimiters, printf, and defensive file operations are the answer to safe file handling in the shell.

Figuring out roles, evidence preservation and notification duties while an incident is already underway wastes precious hours and creates legal risk. This article walks through the complete incident response lifecycle, from detection through containment and eradication to recovery, explains GDPR notification deadlines and delivers a lightweight plan template small development teams can apply right away.

Every piece of user input that flows unvalidated into a Bash command is a potential command injection vector. This article shows how attackers exploit arguments, environment variables, and file contents, where plain quoting reaches its limits, and how whitelisting, wrapper functions, and targeted tests systematically harden Bash scripts against command injection.

Unreviewed Composer dependencies are among the most common entry points in Magento and PHP projects. This article shows how composer audit, Roave Security Advisories and automated CI pipelines reliably surface known vulnerabilities before they reach production, and how teams separate real risk from pure scan noise without manually reviewing every single warning.

Not every random number in PHP is equally secure. While rand() and mt_rand() are fine for games and simulations, they are dangerously predictable for tokens, password reset links or cryptographic keys. random_bytes, random_int and the Randomizer class from PHP 8.2 deliver genuinely cryptographically secure random values for exactly these cases.

Cross-Site Scripting and Prototype Pollution are among the most common and dangerous JavaScript security vulnerabilities. XSS often arises from a single unsafe innerHTML assignment. Prototype Pollution corrupts Object.prototype and makes every instance across the entire program attackable. This article explains both attack vectors and shows concrete countermeasures.

A public API without rate limiting is an open invitation for abuse. Token bucket and sliding window algorithms cap the request load per client, API keys enable differentiated limits, and abuse prevention patterns detect and block malicious behavior before it hits the infrastructure.

A bug bounty program rewards external security researchers for responsibly reporting vulnerabilities, but it only works with a clearly defined scope, tiered rewards, and a mature internal vulnerability management process. This article explains how private and public programs differ, when a company is actually ready, which platforms can help, and how to professionally handle the first real submission that comes in.