Information Security
Guides on OWASP, prompt injection, non-human identities, secrets, supply-chain attacks, and securing AI-generated code.
- What Is Prompt Injection? Prompt injection manipulates an LLM with instructions hidden in data so it ignores its developer's rules. Learn direct and indirect forms and defenses.
- What Is the OWASP Top 10? The OWASP Top 10 is the standard list of the most critical web application security risks. Learn all ten categories and how to use the list.
- What Is SQL Injection (and Why Does AI-Generated Code Keep Writing It)? SQL injection lets attackers run arbitrary database commands through your app. Learn how it works and why AI-generated code repeatedly introduces it.
- What Is Slopsquatting (AI Package Hallucination Attacks)? Slopsquatting is registering the fake package names AI models hallucinate, so generated code installs malware. Learn how it works and how to avoid it.
- How to Scan Your Codebase for Hardcoded Secrets Find API keys and tokens committed to your repo with secret scanners like Gitleaks and TruffleHog, and stop new leaks in CI. A practical tutorial.
- What Is a Non-Human Identity (NHI)? A non-human identity is any machine credential — service accounts, API keys, OAuth tokens — used by software and agents. Learn why NHIs are a top risk.
- What Is the OWASP Non-Human Identity Top 10? The OWASP Non-Human Identity Top 10 catalogs the biggest risks in machine credentials — from stale keys to over-privileged agents. Learn the list.
- What Is MCP (Model Context Protocol) and Why Does It Need Securing? MCP lets AI assistants connect to external tools and data, which makes it a live attack surface. Learn the protocol and its core security risks.
- How to Secure an MCP Server Secure an MCP server: least-privilege tools, authentication, scoped short-lived credentials, and human approval for high-impact actions. A practical guide.
- What Is Agentic AI Security? Agentic AI security governs AI systems that act autonomously with tools and credentials. Learn the risks and the controls that keep agents contained.
- What Is the "Lethal Trifecta" for AI Agents? The 'lethal trifecta' — private data, untrusted content, and external communication — is the combination that makes AI agents dangerous. Learn the concept.
- What Is Zero Trust Architecture? Zero trust means never trusting by default: verify every request, enforce least privilege, and assume breach. Learn the principles in plain language.
- What Is a Software Bill of Materials (SBOM)? An SBOM is a machine-readable inventory of every component in your software. Learn what it contains, its formats, and why it's increasingly required.
- How to Generate an SBOM for Your Project Generate an SBOM with Syft in one command, scan it with Grype for vulnerabilities, and add it to CI. A practical tutorial.
- What Is a Software Supply Chain Attack? A software supply chain attack compromises the tools or dependencies you trust, not your code. Learn the vectors and how to defend against them.
- What Is Broken Access Control (IDOR)? IDOR lets users access other people's data by changing an ID in a request when the app never checks ownership. Learn how it works and how to fix it.
- How to Test Your App for Broken Access Control A practical guide to testing for IDOR and privilege escalation: two accounts, cross-account ID swaps, and role checks. No security background required.
- What Is CSRF (Cross-Site Request Forgery)? CSRF tricks a logged-in user's browser into making requests they didn't intend. Learn how it works, why AI tools skip it, and how to prevent it.
- What Is SSRF (Server-Side Request Forgery)? SSRF tricks your server into fetching an attacker-chosen URL, exposing internal services. Learn how it works, why AI code introduces it, and defenses.
- What Are Security Headers (and How Do You Add Them)? Security headers like CSP, HSTS, and X-Frame-Options harden a site against common attacks. Learn each header and how to add them.
- What Is OAuth 2.0? OAuth 2.0 is a framework that lets apps access your data on another service without sharing your password. Learn the flows and core concepts.
- What Are Passkeys (and Should You Switch)? Passkeys replace passwords with cryptographic key pairs unlocked by your device, resisting phishing. Learn how they work and whether to switch.
- How to Automate API Key Rotation Automate API key rotation so leaked credentials stop working quickly. A practical guide: inventory, short lifetimes, and a rotation job.
- What Is a CVE? A CVE is a standardized identifier for a publicly disclosed security vulnerability. Learn what CVEs are, how they're assigned, and what they mean.
- How to Read a CVE and Know If You're Affected Read a CVE the right way: check affected versions, severity, and exploitability before you panic. A practical tutorial with the fields explained.
- What Is Static Application Security Testing (SAST)? SAST scans your source code for vulnerability patterns before it runs — catching SQL injection, XSS, and more at the earliest stage. Learn the basics.
- How to Add SAST Scanning to a GitHub Repo Add SAST to a GitHub repo with CodeQL or Semgrep, block on critical findings, and tune the noise. A practical, copy-pasteable tutorial.
- What Is Penetration Testing (and Do You Need One)? A penetration test simulates real attacks to find exploitable weaknesses. Learn what a pentest covers and whether your stage actually needs one.
- What Is Ransomware (and How Does It Actually Get In)? Ransomware encrypts your data and demands payment to unlock it. Learn how it actually enters systems — and the backups and hygiene that stop it.
- What Is Phishing-Resistant MFA? Phishing-resistant MFA uses FIDO2 passkeys or hardware keys that can't be tricked by fake sites — unlike SMS codes. Learn why it's the new baseline.
- What Is a Man-in-the-Middle Attack? A man-in-the-middle attack intercepts and can alter traffic between two parties who believe they're talking directly. Learn how it works and how TLS stops it.
- How to Store Passwords Correctly (Hashing vs Encryption) Passwords must be hashed with a slow algorithm like Argon2 or bcrypt, never encrypted or stored in plaintext. Learn why and how, with code examples.
- What the Moltbook Breach Teaches About Shipping Vibecoded Apps A reported January 2026 incident where an AI-built app leaked API tokens is a case study in what goes wrong when code ships without security review.
- Does AI Still Hallucinate (and Why)? Yes, AI models still hallucinate. The 2026 AI Index measured hallucination rates from 22% to 94% across 26 models. Why it happens and what you can do about it.
- The 15 Security Failures Your AI Coding Assistant Ships by Default AI coding assistants default to SQL injection, hardcoded secrets, missing access controls, and 12 other security failures. Here's every one, with the fix and the linked guide.
- InfoSec for Vibecoders: Every Security Concept Your AI-Generated Code Gets Wrong Your AI coding assistant ships SQL injection, exposed secrets, and broken access control by default. Learn every infosec concept you need to catch these before they hit production. 40+ linked guides.
- What Is a Subdomain Takeover? A subdomain takeover lets an attacker claim an abandoned subdomain and serve content on your domain. Learn how it happens and how to stop it.
- What Is Web Cache Poisoning? Web cache poisoning tricks a CDN or proxy into serving an attacker-controlled response to everyone. Learn how it works and how to prevent it.
- What Is an Open Redirect (and Why Do Phishers Love It)? An open redirect lets a site send visitors to an attacker-chosen URL. Learn how it's abused for phishing and how to close it with one validation.
- What Is Clickjacking (and How Do You Prevent It)? Clickjacking hides your page inside an invisible frame so clicks land on buttons the user can't see. Learn how it works and the one-header fix.
- What Is Path Traversal (Directory Traversal)? Path traversal lets an attacker read files outside the intended directory using ../ sequences. Learn how it works and the safe way to serve files.
- Path Traversal in AI-Generated Code: How Your File Download Endpoint Gets Hacked AI assistants build file-serving endpoints with string concatenation that attackers exploit with ../. Here are the vulnerable patterns your AI generates, the encoding tricks that bypass naive fixes, and the one correct solution.
- What Is Credential Stuffing (and How Does It Get Your Accounts)? Credential stuffing reuses passwords leaked from one site to break into others. Learn how the attacks work and why unique passwords are the only real defense.
- What Is Dependency Confusion (and How Do You Prevent It)? Dependency confusion makes your build install a malicious public package instead of your private one. Learn how the attack works and how to pin it out.
- Why Your Frontend API Keys Are Not Secret Any key shipped in frontend JavaScript can be extracted by anyone. Learn what frontend keys can and can't protect, and how to gate access properly.
- What Is HSTS (and Why Your HTTPS Isn't Enough)? HSTS tells browsers to always use HTTPS for your domain, closing the downgrade window. Learn how it works and how to enable it safely.
- JWT Security: Common Mistakes That Get Tokens Stolen JWTs are easy to generate and easy to get wrong. Learn the mistakes — algorithm confusion, weak secrets, no expiry — that turn tokens into access.
- How to Find and Remove Secrets From Git History Deleting a secret from your code doesn't remove it from git history. Find leaked keys with gitleaks, scrub history, and rotate what leaked.
- What Is Content Security Policy (CSP)? CSP is a header that tells the browser which scripts and resources a page may load, stopping injected code. Learn how to set it up without breaking your site.
- What Is Bug Bounty Disclosure? Bug bounty disclosure explains how companies manage vulnerability reports from external researchers — from triage and rewards to coordinated disclosure.
- What Is a Bug Bounty Program? A bug bounty program pays security researchers to find and report vulnerabilities. Learn how they work, what they cost, and whether your project needs one.
- How to Prevent Credential Stuffing Attacks Stop credential stuffing with multi-factor authentication, rate limiting, breached-password detection, and bot detection. Practical steps for any web app.