JJenna's Runbooks5h ago · 5 min readDefending an MCP server against prompt injection through CloudTrailConsoleTrack catches out-of-band AWS changes and links them to EKS incidents (demo). Its triage agent reads CloudTrail to explain those incidents, and every event it reads carries text the caller chos1Oblog.jennasrunbooks.com
SSunnatulla E.5h ago · 9 min readSix security holes I check for before a Supabase + Stripe app goes liveApps built fast with Lovable, Bolt, Cursor or Claude Code tend to break in the same few places. The demo looks great, and then one of these six things is sitting in the repo. I wrote a small free checsunnatulla.hashnode.dev
AAbdus Salam16m ago · 4 min readCVE-2026-111497: The Brotli Decoder Bug and How to Check Your StackA compression library bug does not sound like a big deal until you count how many programs decompress data they did not ask for. CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, taheadkit.hashnode.dev
SSohel Siddique35m ago · 2 min readShadow AI apps: what IT can do about tools staff build with AILast updated 25 October 2026. Written by TeamOnly. We make one of the places builders can deploy to, and we say so where it comes up. Quick answer: Assume these apps already exist. Find them without bteamonly.hashnode.dev
MMuhammad Wasim1h ago · 6 min readSHA-256, SHA-1 and MD5 in 2026: What a Hash Is Actually ForHash functions show up everywhere in a developer's week: a checksum next to a download, an ETag in an HTTP response, a Git commit ID, a cache key, a webhook signature. Because they look alike (a long toolsphare-dev-2026.hashnode.dev
IIsrar Kundi1h ago · 5 min readVibe-Coded App Security Holes to Close Before Real UsersVibe-coded app security holes are the gaps your AI builder left open while making the app work. Before real users sign up, close four of them: open database tables, secrets in front-end code, auth cheisrar-kundi.hashnode.dev
PPowerduck1h ago · 4 min readRead-Only Database Access and SafetyQuick answer: The desktop connects to the database through saved profiles whose passwords are never returned, and it runs a read-only SELECT with a bounded row set through database.runSelect. Writes ablogs.powerduck.com
PPowerduck1h ago · 4 min readJWS Signature Checks and Their LimitsQuick answer: JWS signature verification runs locally and supports asymmetric signatures, using RFC 8785 canonical JSON with A2A field-presence rules. It never follows key URLs provided in the card, sblogs.powerduck.com
MMo' Claudius1h ago · 14 min readYour OG Images Run on Your Server: Dissecting Next.js CVE-2026-94545Every Next.js site with a blog eventually grows the same route. Someone wants the posts to look good when they are shared, so a file appears that takes a title, drops it into a nice layout with the sikodedmo.dev
KKazem Mortazavi1h ago · 2 min readThe Back Door Was a Vendor: Lessons From the Crédit Mutuel Arkéa Bank HeistMost banking-security discussions focus on customer accounts: strong passwords, one-time codes, fraud scoring. The recent heist at the French cooperative bank Crédit Mutuel Arkéa is a reminder that sosecurityland.hashnode.dev
