Last week we had an outage where our API was accepting requests with invalid or missing signatures for about 90 minutes. A junior dev added a .IsValid() check but forgot to actually return early on fa
PJPriya and 1 more commentedSo we had a shared API key in a single env file. Rotating it meant updating prod, staging, and three client apps. We did prod first, thought we were done, deployed a change that referenced the old key
ADAlex and 3 more commentedWe had the classic problem: tokens in AsyncStorage are accessible to any javascript running in the webview. Got paranoid about it after a security audit, so we moved to a hybrid approach that's actual
Join discussionHi everyone here. I am a wordpress enthusiast, and by an enthusiast I mean I install wordpress, install plugins, make some changes to code and then publish the websites on the internet. I dont have the slightest idea of what coding is. I want to lear...
Join discussion