How AST-Based Static Analysis Catches Dockerfile Vulnerabilities That Regex Scanners MissA multi-stage build with obfuscated instructions or unpinned stage contexts bypasses standard regex linters with minimal effort. Consider this production Dockerfile: # syntax=docker/dockerfile:1 FROM 3d ago · 10 min readdibyadipan.hashnode.dev
Beyond the .env File: The OS Mechanics of Secret InjectionYou want to pass database credentials to a Node.js process without writing a .env file to disk. The standard advice is to inject the credentials directly into the environment. But how does that actual1Jun 20 · 5 min readdibyadipan.hashnode.dev
Session Revocation and Replay Detection with RedisWhen a user clicks "Logout from all devices," you need to instantly invalidate every active session they have. If you built your authentication with purely stateless JWTs, you cannot do this. You have1Jun 20 · 5 min readdibyadipan.hashnode.dev
Designing a Secrets Manager Assuming the Database Will Be LeakedAssume the database is gone. An attacker just dumped Postgres. They have every ciphertext, every nonce, and every project salt. This is the baseline threat model for Vaultify. The system guarantees th1Jun 20 · 7 min readdibyadipan.hashnode.dev
