MMilan Nikic·1d agoCross-Site Scripting (XSS) in Java and React: Reflected and Stored XSS (Part 1)Prevent reflected and stored XSS in Java and React with practical examples of output encoding, safe rendering, and HTML sanitization.20 min read·securitydepth.hashnode.dev
PPrithwiraj Bose·Nov 1A Safer Exit From `request`: Incremental Migration for Legacy Node.js ServicesWhy changing an HTTP client is an application-compatibility project, and how to reduce the blast radius without overstating what a wrapper can fix.6 min read·sribasu.hashnode.dev
CCruxtab Technologies Pvt. Ltd.·Oct 31Implementing Shopify GDPR Compliance Webhooks for Customer Data PrivacyLearn how to implement Shopify customers/data_request, customers/redact, and shop/redact webhooks with authentication and reliable data cleanup.4 min read·cruxtab-technologies.hashnode.dev
CCruxtab Technologies Pvt. Ltd.·Oct 31Security Audit of a Shopify App: GDPR, Data Isolation, Secrets, and Submission ProtectionExplore six important Shopify app security risks involving GDPR webhooks, cross-shop data access, exposed credentials, form abuse, and HTML injection.4 min read·cruxtab-technologies.hashnode.dev
CCruxtab Technologies Pvt. Ltd.·Oct 30Designing Secure Webhooks for Multi-Tenant ApplicationsLearn how to secure generic webhooks with server-side validation, tenant isolation, credential protection, and protection against server-side request forgery.2 min read·cruxtab-technologies.hashnode.dev
CCruxtab Technologies Pvt. Ltd.·Oct 30Protecting API Credentials in Shopify App IntegrationsLearn how to protect API keys, service-account credentials, and webhook URLs in Shopify applications using server-side processing and secure configuration.3 min read·cruxtab-technologies.hashnode.dev
CCruxtab Technologies Pvt. Ltd.·Oct 29Designing Privacy-Aware Error Notifications for Web ApplicationsLearn how to reduce sensitive data exposure in Slack error alerts through data minimization, URL sanitization, access controls, and testing.3 min read·cruxtab-technologies.hashnode.dev
NNash Hasan·Oct 23Autonomous Codebase Security Auditing: Dissecting Cloudflare’s Security-Audit Skill, Multi-Agent Verification, and Institutional HardeningA multi-agent auditing loop pairs attack surface ledgers with skeptical verification to cut false positives and protect sovereign data.11 min read·blog.edtechniti.com
Vvidit·Oct 22PHP2Shell: Two Critical PHP Flaws That Could Turn a Website Into an Attacker’s Entry PointInside CVE-2026-109618 and CVE-2026-109619 — how memory corruption can lead to unauthenticated remote code execution, why the exposure is so widespread, and what defenders must do now.19 min read·viditp.hashnode.dev
MMilan Nikic·Oct 21XML external entity injection: A security architect's perspective (Part 2)Disabling DTDs in one parser doesn't scale. How to eliminate XXE architecturally: central parser policy, gateway validation, and dependency control.18 min read·securitydepth.hashnode.dev
