--- title: "#security articles | Hashnode" description: "All about security. Read the latest #security articles and tutorials on Hashnode." url: "https://hashnode.com/tag/security" --- Tag # #security 14,261 posts · 2,310 followers [Abdus Salam](https://hashnode.com/@aheadkit) · [7h ago](https://hashnode.com/posts/rotating-a-jwt-signing-key-breaks-every-token-signed-with-the-old-one/6af40baa82cbd221a078f1eb) ### [Rotating a JWT Signing Key Breaks Every Token Signed With the Old One](https://aheadkit.hashnode.dev/rotating-a-jwt-signing-key-breaks-every-token-signed-with-the-old-one?utm_source=hashnode&utm_medium=feed) Key rotation sounds like a one-line ops task. Generate a new secret, swap it in, done. I ran the experiment to see what actually breaks, because "swap it in" hides a question nobody asks out loud: wha 5 min read · [aheadkit.hashnode.dev](https://aheadkit.hashnode.dev/rotating-a-jwt-signing-key-breaks-every-token-signed-with-the-old-one?utm_source=hashnode&utm_medium=feed) [MadeByBrain](https://hashnode.com/@madebybrain) · [2m ago](https://hashnode.com/posts/ai-agents-credentials-secrets-hygiene-2026/6af474fca96d6e7565e5537a) ### [AI agents and credentials: protect secrets technically instead of trusting](https://madebybrain.hashnode.dev/ai-agents-credentials-secrets-hygiene-2026?utm_source=hashnode&utm_medium=feed) AI agents leak credentials into public repositories. How to secure secrets, tokens and agent permissions technically, not by prompt. 11 min read · [madebybrain.hashnode.dev](https://madebybrain.hashnode.dev/ai-agents-credentials-secrets-hygiene-2026?utm_source=hashnode&utm_medium=feed) [nodethemescom](https://hashnode.com/@nodethemes) · [22m ago](https://hashnode.com/posts/woocommerce-card-testing-why-your-captcha-is-not-enough/6af47049609eccf4e626ee4a) ### [WooCommerce Card Testing: Why Your CAPTCHA Is Not Enough](https://nodethemes.hashnode.dev/woocommerce-card-testing-why-your-captcha-is-not-enough?utm_source=hashnode&utm_medium=feed) If your WooCommerce store suddenly shows dozens of failed orders for your cheapest product, with names like "asdf qwer", you are probably being used for card testing: a script checking which stolen ca 4 min read · [nodethemes.hashnode.dev](https://nodethemes.hashnode.dev/woocommerce-card-testing-why-your-captcha-is-not-enough?utm_source=hashnode&utm_medium=feed) [nodethemescom](https://hashnode.com/@nodethemes) · [24m ago](https://hashnode.com/posts/hardening-wordpress-without-locking-yourself-out-a-risk-sorted-checklist/6af46fea1492b451faa73ffb) ### [Hardening WordPress Without Locking Yourself Out: A Risk-Sorted Checklist](https://nodethemes.hashnode.dev/hardening-wordpress-without-locking-yourself-out-a-risk-sorted-checklist?utm_source=hashnode&utm_medium=feed) Most WordPress security advice is a list of switches. The problem is not the list, it is the order: people turn on ten things at once, the login page breaks, and they are locked out of their own site. 4 min read · [nodethemes.hashnode.dev](https://nodethemes.hashnode.dev/hardening-wordpress-without-locking-yourself-out-a-risk-sorted-checklist?utm_source=hashnode&utm_medium=feed) [Prashant Koirala](https://hashnode.com/@prashantkoirala) · [26m ago](https://hashnode.com/posts/running-agent-code-is-becoming-a-sandboxing-problem/6af46f6f1492b451faa5f0cf) ### [Running agent code is becoming a sandboxing problem](https://blog.prashantkoirala.info.np/running-agent-code-is-becoming-a-sandboxing-problem?utm_source=hashnode&utm_medium=feed) Prompt injection will not be patched away. A hijacked coding agent can reach only what its sandbox, egress rules and credentials allow. 34 min read · [blog.prashantkoirala.info.np](https://blog.prashantkoirala.info.np/running-agent-code-is-becoming-a-sandboxing-problem?utm_source=hashnode&utm_medium=feed) [SublyNow Team](https://hashnode.com/@sublynow) · [4h ago](https://hashnode.com/posts/before-you-pay-a-third-party-to-activate-chatgpt-plus-or-pro-check-these-five-things/6af4385c43a5ac55d3c48d35) ### [Before You Pay a Third Party to Activate ChatGPT Plus or Pro, Check These Five Things](https://sublynow.hashnode.dev/before-you-pay-a-third-party-to-activate-chatgpt-plus-or-pro-check-these-five-things?utm_source=hashnode&utm_medium=feed) A pre-payment checklist for third-party AI subscription activation: account ownership, quoted total, refund terms, order tracking, data handling. 4 min read · [sublynow.hashnode.dev](https://sublynow.hashnode.dev/before-you-pay-a-third-party-to-activate-chatgpt-plus-or-pro-check-these-five-things?utm_source=hashnode&utm_medium=feed) [IP99](https://hashnode.com/@ip99) · [36m ago](https://hashnode.com/posts/reading-usage-type-20-network-scene-codes-that-aren-t-a-risk-verdict/6af46ceef50d6138ae3ad5c9) ### [Reading usage\_type: 20 Network Scene Codes That Aren't a Risk Verdict](https://ip99.hashnode.dev/reading-usage-type-20-network-scene-codes-that-aren-t-a-risk-verdict?utm_source=hashnode&utm_medium=feed) A usage\_type of IDC is not a reason to refuse a customer, and DYN is not a reason to trust one. On IP99 by ThreatHunter, network.usage\_type is a network scene code: what kind of network the address si 6 min read · [ip99.hashnode.dev](https://ip99.hashnode.dev/reading-usage-type-20-network-scene-codes-that-aren-t-a-risk-verdict?utm_source=hashnode&utm_medium=feed) [ZyVOP](https://hashnode.com/@zyvop) · [8h ago](https://hashnode.com/posts/webhook-security-verify-signatures-stop-replays-handle-retries-x05wj/6af4009606e33ac9878cf11a) ### [Webhook Security: Verify Signatures, Stop Replays, Handle Retries](https://blog.zyvop.com/webhook-security-verify-signatures-stop-replays-handle-retries-x05wj?utm_source=hashnode&utm_medium=feed) How to accept webhooks safely: verify the signature on the raw body, reject replays with timestamps and event IDs, and survive retries, with tested Python code. 28 min read · [blog.zyvop.com](https://blog.zyvop.com/webhook-security-verify-signatures-stop-replays-handle-retries-x05wj?utm_source=hashnode&utm_medium=feed) [2](https://hashnode.com/posts/webhook-security-verify-signatures-stop-replays-handle-retries-x05wj/6af4009606e33ac9878cf11a) [Hu Jin](https://hashnode.com/@whoai) · [1h ago](https://hashnode.com/posts/sandbox-isolation-for-mcp-servers-process-filesystem-and-network-lockdown-security-4/6af466033b9d31090a8ffe72) ### [Sandbox Isolation for MCP Servers: Process, Filesystem, and Network Lockdown (Security 4)](https://whoai.hashnode.dev/sandbox-isolation-for-mcp-servers-process-filesystem-and-network-lockdown-security-4?utm_source=hashnode&utm_medium=feed) How to isolate an MCP server process with containers or VMs, lock down the filesystem and network, drop capabilities, and shrink the blast radius of a 4 min read · [whoai.hashnode.dev](https://whoai.hashnode.dev/sandbox-isolation-for-mcp-servers-process-filesystem-and-network-lockdown-security-4?utm_source=hashnode&utm_medium=feed) [Kazem Mortazavi](https://hashnode.com/@kazem-mortazavi) · [1h ago](https://hashnode.com/posts/reading-a-firewall-datasheet-which-throughput-number-actually-matters/6af45caf9e8bce40fbaf70a2) ### [Reading a Firewall Datasheet: Which Throughput Number Actually Matters](https://securityland.hashnode.dev/reading-a-firewall-datasheet-which-throughput-number-actually-matters?utm_source=hashnode&utm_medium=feed) A few weeks ago a colleague was called in to look at a slow internet connection at a company headquarters. A year earlier the team had replaced its desktop firewall with a larger rack-mount appliance, 2 min read · [securityland.hashnode.dev](https://securityland.hashnode.dev/reading-a-firewall-datasheet-which-throughput-number-actually-matters?utm_source=hashnode&utm_medium=feed)