Hammad Khan (@hammadxcm)

Building a Chrome Extension That Bridges Three SaaS Tools

Building a Chrome Extension That Bridges Three SaaS Tools Chrome extensions live in a strange place. They're not quite apps. They're not quite scripts. They run in a browser context, talk to a backend

Jun 10 · 9 min readhammad-khan.hashnode.dev

From Singleton AuditService to Event-Driven AuditModule: A Decoupling Story

From Singleton AuditService to Event-Driven AuditModule: A Decoupling Story Every codebase I've worked on for more than six months has an AuditTrailService somewhere. It starts life as a helpful singl

May 23 · 10 min readhammad-khan.hashnode.dev

CSRF Double-Submit Cookies: The Underrated Defense for Same-Origin SaaS

The first time a pen tester filed a CSRF finding against a portal I owned, my reaction was the same as everyone else's: "We're SameSite=Lax. Aren't we fine?" We weren't fine. And the fix wasn't the fr

May 22 · 10 min readhammad-khan.hashnode.dev

CSP Headers in Practice: Lessons From a Real Security Audit Pass

CSP Headers in Practice: Lessons From a Real Security Audit Pass The first time I deployed a strict Content Security Policy in production, the application broke in three places nobody had ever thought

May 16 · 8 min readhammad-khan.hashnode.dev

HMAC Request Signing for Third-Party Webhook Security

HMAC Request Signing for Third-Party Webhook Security Webhook endpoints are the most under-secured class of route in most codebases. They take requests from the internet, often without a session, ofte

May 13 · 8 min readhammad-khan.hashnode.dev

Hammad Khan

About

Available for

Hammad Khan's blogs

Building a Chrome Extension That Bridges Three SaaS Tools

From Singleton AuditService to Event-Driven AuditModule: A Decoupling Story

CSRF Double-Submit Cookies: The Underrated Defense for Same-Origin SaaS

CSP Headers in Practice: Lessons From a Real Security Audit Pass

HMAC Request Signing for Third-Party Webhook Security

Hammad Khan

About

Available for

Hammad Khan's blogs

Building a Chrome Extension That Bridges Three SaaS Tools

From Singleton AuditService to Event-Driven AuditModule: A Decoupling Story

CSRF Double-Submit Cookies: The Underrated Defense for Same-Origin SaaS

CSP Headers in Practice: Lessons From a Real Security Audit Pass

HMAC Request Signing for Third-Party Webhook Security

Hammad Khan

About

Available for

Hammad Khan's blogs

Building a Chrome Extension That Bridges Three SaaS Tools

From Singleton AuditService to Event-Driven AuditModule: A Decoupling Story

CSRF Double-Submit Cookies: The Underrated Defense for Same-Origin SaaS

CSP Headers in Practice: Lessons From a Real Security Audit Pass

HMAC Request Signing for Third-Party Webhook Security

Search Hashnode

Hammad Khan

About

Available for

Hammad Khan's blogs

Building a Chrome Extension That Bridges Three SaaS Tools

From Singleton AuditService to Event-Driven AuditModule: A Decoupling Story

CSRF Double-Submit Cookies: The Underrated Defense for Same-Origin SaaS

CSP Headers in Practice: Lessons From a Real Security Audit Pass

HMAC Request Signing for Third-Party Webhook Security