Security Guides for Developers

13 guides

Cross-Site Scripting (XSS)

XSS allows attackers to inject malicious scripts into web pages viewed by other users, enabling session hijacking, data theft, and defacement.

7 guides

SQL Injection

SQL Injection allows attackers to interfere with database queries, potentially reading, modifying, or deleting data, and in some cases executing system commands.

13 guides

Cross-Site Request Forgery (CSRF)

CSRF forces authenticated users to execute unwanted actions on a web application, exploiting the trust a site has in a user's browser.

Insecure Direct Object References (IDOR)

IDOR occurs when an application exposes internal implementation objects (like database IDs) and fails to verify that users are authorized to access the referenced resource.

Broken Authentication

Broken authentication encompasses weaknesses in session management, credential handling, and identity verification that allow attackers to compromise user accounts.

Medium

14 guides

Security Misconfiguration

Security misconfiguration encompasses insecure default settings, open cloud storage, verbose error messages, unnecessary features, and missing security headers.

14 guides

Sensitive Data Exposure

Sensitive data exposure occurs when applications fail to adequately protect sensitive information like credentials, tokens, personal data, or financial information.

Medium

Missing Rate Limiting

Missing rate limiting allows attackers to perform brute force attacks, credential stuffing, API abuse, and denial of service by making unlimited requests.

5 guides

JWT Vulnerabilities

JWT vulnerabilities include algorithm confusion, missing validation, token leakage, and improper key management that can lead to authentication bypass.

7 guides

Path Traversal

Path traversal allows attackers to access files and directories stored outside the intended directory by manipulating file path references.

7 guides

Command Injection

Command injection allows attackers to execute arbitrary operating system commands on the server through vulnerable application interfaces.

9 guides

Server-Side Request Forgery (SSRF)

SSRF allows attackers to induce the server to make HTTP requests to arbitrary destinations, potentially accessing internal services, metadata APIs, and private networks.

8 guides

File Upload Vulnerabilities

Insecure file upload handling can allow attackers to upload malicious files including web shells, malware, or files that exploit server-side processing.

14 guides

Insecure Deserialization

Insecure deserialization allows attackers to manipulate serialized objects to achieve remote code execution, replay attacks, injection, or privilege escalation.

Row Level Security (RLS) Bypass

RLS bypass vulnerabilities occur when database-level access policies are missing, misconfigured, or can be circumvented, exposing data across tenant boundaries.