#Security

Verify Webhook Payloads: HMAC, Timestamps, and Replay Protection

Build an Express receiver that rejects forged, tampered, and replayed webhooks with constant-time HMAC checks.

Tutorial · 1w ago3

Sandbox Your AI Coding Agent in a Locked-Down Docker Container

Run Claude Code and Cursor's CLI agent inside a hardened, egress-filtered container with a human approval gate.

Tutorial · 1w ago1

The Security Question Your Scanner Can't Ask

Access control tops OWASP's 2025 list again because authorization is business logic, and no tool audits that for you.

Article · 1w ago1

One Vendor Finally Published the Attacks It Can't Catch

An open benchmark with a public failure list beats unverifiable detection claims — but a self-scored 99.8% still isn't proof.

Article · 1w ago0

Stop Treating Your JWT Like a Database

The payload is base64, not ciphertext — and the fix isn't encryption, it's putting less in the token.

Article · 1w ago0

Your Keras Model File Is Executable Code, Not Data

safe_mode keeps getting bypassed because the format was built to run whatever the config names.

Article · 1w ago0

A Schema Name Becomes a Shell in n8n's Latest RCE

Prototype pollution in n8n's XML and GSuiteAdmin nodes chains a poisoned env var straight to code execution — patch today.

Article · 1w ago0

Microsoft's Agent Identity Model Is the Blueprint to Steal

Three permission planes solve the over-privileged agent problem, but a publish-time identity swap will bite the unprepared.

Article · 1w ago2

Your LLM Writes GitHub Actions Like It's 2022

Model-generated workflows inherit the permissive habits of their training data; gate the permissions block, not just the syntax.

Article · 1w ago0

Everybody Gets to Poison This AI's Memory

A Show HN experiment inverts per-user memory silos and live-demos the failure modes you're supposed to design against.

Article · 1w ago5

21,000 Exposed MCP Servers Are a Defaults Problem

New internet-wide scanning research shows MCP's authorization spec works — the way developers deploy servers doesn't.

Article · 1w ago0

GCC Finally Has a Plan to Kill the Trampoline

New built-ins on GCC's development branch make capturing nested functions work without executable stacks.

Article · 2w ago0

Unicode Never Forgets, and That's a Security Problem

Twelve meaningless kanji, encoded forever by accident, explain why blocklist-style input validation keeps losing.

Article · 2w ago0

Build a Self-Hosted WireGuard VPN with Split Tunneling

Stand up WireGuard on a cheap Ubuntu VPS, split-tunnel your traffic, and manage peers with zero downtime.

Tutorial · 2w ago0

Ruby 4.0's New RCE Chain Proves Patching Gadgets Won't Save You

A fresh universal Marshal.load chain works back to Ruby 3.3 — and the real lesson is architectural, not a version bump.

Article · 2w ago0