Answers
Direct answers to the questions engineering teams actually ask when choosing, running, and justifying application security tooling. One question per page, answered in the first paragraph.
52 answers
How do I secure Terraform and infrastructure as code?
Your state file has your database password in it, in plaintext.
Full answerFrameworks & APIsHow do I secure a Flask app?
Flask's debug console is a shell. Make sure it never reaches production.
Full answerFrameworks & APIsHow do I secure an Express API?
Five lines of middleware, then the part middleware can't do for you.
Full answerComplianceA customer sent us a security questionnaire. What do we actually need?
The deal is blocked, the spreadsheet has 200 rows, and most of it is the same six questions.
Full answerScanning & toolingHow do I scan my code for security vulnerabilities?
Two scans, not one. Most people set up the easy one and stop there.
Full answerFrameworks & APIsHow do I secure a Rails app?
Rails protects you from most things. `Order.find(params[:id])` isn't one of them.
Full answerFrameworks & APIsHow do I secure a webhook endpoint?
Anyone can post to your webhook URL. The signature is the only thing that isn't guesswork.
Full answerScanning & toolingHow often should you scan code for vulnerabilities?
Quarterly scanning finds problems three months after they shipped. There's a better cadence.
Full answerScanning & toolingWhat is the difference between SAST, SCA, DAST and ASPM?
Four acronyms, three scanners, and one of them isn't a scanner at all.
Full answerAI-generated codeIs AI-generated code less secure than human-written code?
Twenty-four apps, 561 vulnerabilities, and the same five mistakes nearly every time.
Full answerAuth & access controlHow do I stop users accessing other users' data?
Change one number in a request and you're reading someone else's account. Here's why that happens.
Full answerFixing vulnerabilitiesWhat is dependency confusion?
Your internal package name is public information. So is the fact it's internal.
Full answerAuth & access controlWhat are the most common JWT mistakes?
A JWT payload is base64, not encryption. Anyone holding the token can read it.
Full answerFixing vulnerabilitiesWhat is a race condition in a web app and how do I fix it?
Check-then-act works fine until two requests arrive four milliseconds apart.
Full answerAuth & access controlHow do I store passwords securely?
If your hashing function is fast, that's the bug.
Full answerFixing vulnerabilitiesWhat is insecure deserialisation and how do I fix it?
Unpickling untrusted data isn't a vulnerability to patch. It's remote code execution by design.
Full answerAI-generated codeWhat is prompt injection and how do I prevent it?
There's no input validation for this. The mitigation is architectural.
Full answerAI-generated codeHow do I secure an MCP server?
The model decides which tool to call. Don't make its judgement the boundary.
Full answerFrameworks & APIsHow do I secure an API endpoint?
Five layers. Almost everyone gets the first one right and skips the second.
Full answerHardening & configWhat should I log for security?
Log the authorisation failures. That's the signal everyone throws away.
Full answerHardening & configWhat security headers should I set?
Four take a minute. The fifth is worth the afternoon it costs.
Full answerFrameworks & APIsHow do I secure a Next.js app?
Four ways the server/client boundary leaks, and why middleware isn't an auth layer.
Full answerInfrastructureHow do I secure a Kubernetes cluster?
Kubernetes Secrets are base64. That's encoding, not encryption.
Full answerFrameworks & APIsHow do I secure a Laravel app?
`APP_DEBUG=true` in production hands out your environment variables.
Full answerFrameworks & APIsHow do I secure a Spring Boot app?
`/actuator/env` lists your environment variables. Check what yours exposes.
Full answerFrameworks & APIsHow do I secure a FastAPI app?
Pydantic covers input. It has no opinion on whether this user owns that record.
Full answerFrameworks & APIsHow do I secure a Go web service?
`text/template` doesn't escape. One import away from stored XSS.
Full answerFrameworks & APIsHow do I secure a GraphQL API?
One endpoint, and the client writes the query. Route-level auth doesn't fit.
Full answerHardening & configHow do I handle file uploads securely?
The extension, the filename and the content type are all attacker-controlled.
Full answerHardening & configHow do I keep secrets out of my code?
Deleting the commit doesn't help. Every clone still has it.
Full answerInfrastructureHow do I secure a Docker container?
Containers run as root unless you say otherwise. Most people never say otherwise.
Full answerFrameworks & APIsHow do I secure a Django app?
Django protects you from most things. `get_object_or_404` isn't one of them.
Full answerScanning & toolingHow do I know if my web app is secure?
You can't prove it is. You can find out fairly quickly whether it isn't.
Full answerFixing vulnerabilitiesHow do I prevent SSRF?
Blocking `localhost` doesn't work. Neither does blocking `127.0.0.1`. Here's why.
Full answerAuth & access controlHow do I prevent account takeover?
Nobody's cracking your bcrypt hashes. They're using a password from someone else's breach.
Full answerHardening & configHow do I handle errors without leaking information?
"User not found" tells an attacker which emails are registered.
Full answerFixing vulnerabilitiesHow do I fix SQL injection in Node.js?
Parameterise, don't escape. And the ORM you're using is only safe until someone writes a raw query.
Full answerFixing vulnerabilitiesHow do I fix vulnerable dependencies?
Most of your dependency alerts don't affect you. The hard part is working out which.
Full answerFixing vulnerabilitiesHow do I fix XSS in React?
React escapes JSX for you. There are four doors it doesn't cover.
Full answerFixing vulnerabilitiesHow do I fix SQL injection in Python?
The `%s` isn't string formatting. That distinction is the whole bug.
Full answerFixing vulnerabilitiesHow do I fix XXE?
Your XML parser will read `/etc/passwd` if the document asks it to.
Full answerFixing vulnerabilitiesHow do I fix an open redirect?
`//evil.com` is a valid redirect target and it passes most validation.
Full answerFixing vulnerabilitiesHow do I fix mass assignment?
Add `"is_admin": true` to the signup request and see what happens.
Full answerAI-generated codeHow do I check if my Supabase app is secure?
The anon key is meant to be public. That's only fine if RLS is on.
Full answerFixing vulnerabilitiesHow do I fix path traversal?
Stripping `../` doesn't work. `....//` survives it.
Full answerFixing vulnerabilitiesHow do I fix command injection?
`exec` runs a shell. `execFile` doesn't. That's the whole bug.
Full answerFixing vulnerabilitiesHow do I fix CSRF?
If you're not using cookies for auth, you don't have this problem.
Full answerHardening & configHow do I configure TLS properly?
`rejectUnauthorized: false` undoes everything else on this page.
Full answerAuth & access controlShould I use API keys or OAuth?
If there's a user granting permission, it's OAuth. If not, a key is fine.
Full answerAI-generated codeWhat should I check before shipping AI-generated code to production?
Four of these take ten minutes with a browser and a terminal. The fifth is the one that gets people.
Full answerScanning & toolingHow do I add security scanning to GitHub Actions?
The setup takes twenty minutes. Making sure your team doesn't turn it off takes slightly longer.
Full answerScanning & toolingIs Semgrep suitable for engineering teams that want to write custom security rules?
Strong yes on ergonomics, with one structural limit worth understanding first.
Full answer