--- title: "#websecurity articles | Hashnode" description: "Explore 411 articles tagged #websecurity on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/websecurity" --- Tag # #websecurity 411 posts · 35 followers [ZyVOP](https://hashnode.com/@zyvop) · [6d ago](https://hashnode.com/posts/node-js-security-checklist-for-2026-fym1k/6aec63e08fe3a91e6d6a6a12) ### [Node.js Security Checklist for 2026](https://blog.zyvop.com/node-js-security-checklist-for-2026-fym1k?utm_source=hashnode&utm_medium=feed) A practical, copy-paste-friendly checklist covering security headers, rate limiting, password hashing, dependency audits, and supply-chain safety for Node.js apps. 21 min read · [blog.zyvop.com](https://blog.zyvop.com/node-js-security-checklist-for-2026-fym1k?utm_source=hashnode&utm_medium=feed) [Gerwin](https://hashnode.com/@fuckit) · [Nov 2](https://hashnode.com/posts/your-recovery-email-is-a-spare-key-treat-it-like-one/6ae89241a5103636bef52472) ### [Your Recovery Email Is a Spare Key. Treat It Like One.](https://fuckit.hashnode.dev/your-recovery-email-is-a-spare-key-treat-it-like-one?utm_source=hashnode&utm_medium=feed) Your recovery email can reset your main password. Abandoned addresses, lapsed domains, the circular recovery trap and a fifteen-minute audit to close them. 9 min read · [fuckit.hashnode.dev](https://fuckit.hashnode.dev/your-recovery-email-is-a-spare-key-treat-it-like-one?utm_source=hashnode&utm_medium=feed) [Sina Rezaei](https://hashnode.com/@sinarezaei) · [Oct 30](https://hashnode.com/posts/your-ai-pentester-found-an-ssrf-can-it-reproduce-the-attack/6ae3e417acc4ad96b8f4429a) ### [Your AI Pentester Found an SSRF. Can It Reproduce the Attack?](https://sinarezaei.hashnode.dev/your-ai-pentester-found-an-ssrf-can-it-reproduce-the-attack?utm_source=hashnode&utm_medium=feed) The first scan found an SSRF. The second one didn't. I wouldn't close the finding just yet. The endpoint accepts a URL, fetches the resource, and returns its response. During the first scan, the agent 3 min read · [sinarezaei.hashnode.dev](https://sinarezaei.hashnode.dev/your-ai-pentester-found-an-ssrf-can-it-reproduce-the-attack?utm_source=hashnode&utm_medium=feed) [ZyVOP](https://hashnode.com/@zyvop) · [Oct 27](https://hashnode.com/posts/ssl-tls-and-https-explained-what-the-padlock-actually-means-ix26r/6ae0456fc10104f384205606) ### [SSL, TLS, and HTTPS Explained: What the Padlock Actually Means](https://blog.zyvop.com/ssl-tls-and-https-explained-what-the-padlock-actually-means-ix26r?utm_source=hashnode&utm_medium=feed) A plain-English guide to SSL, TLS, and HTTPS: how they differ, how a secure connection is built, and what the padlock does and doesn’t tell you. 11 min read · [blog.zyvop.com](https://blog.zyvop.com/ssl-tls-and-https-explained-what-the-padlock-actually-means-ix26r?utm_source=hashnode&utm_medium=feed) [vidit](https://hashnode.com/@Viditp) · [Oct 21](https://hashnode.com/posts/emudhra-certificate-compromise-private-key-4/6ad91de55380bf475fed5a6b) ### [The eMudhra Certificate Compromise: The Internet Trusted a Private Key That Was Literally the Number 4](https://viditp.hashnode.dev/emudhra-certificate-compromise-private-key-4?utm_source=hashnode&utm_medium=feed) Eight eMudhra CA keys were compromised in Oct 2026. Plain-English explanation, timeline, and an action checklist for IT teams and everyday users. 8 min read · [viditp.hashnode.dev](https://viditp.hashnode.dev/emudhra-certificate-compromise-private-key-4?utm_source=hashnode&utm_medium=feed) [Deep Patel](https://hashnode.com/@pdeep1506) · [Oct 19](https://hashnode.com/posts/laravel-react-aws-production-deployment/6ad65b33f0abdaaf688b650a) ### [How I Deployed a Laravel + React Application to Production on AWS](https://pdeep1506.hashnode.dev/laravel-react-aws-production-deployment?utm_source=hashnode&utm_medium=feed) Step-by-step case study: how I set up AWS, a production LAMP stack, security testing, and AWS WAF to deploy a Laravel and React app safely. 4 min read · [pdeep1506.hashnode.dev](https://pdeep1506.hashnode.dev/laravel-react-aws-production-deployment?utm_source=hashnode&utm_medium=feed) [2](https://hashnode.com/posts/laravel-react-aws-production-deployment/6ad65b33f0abdaaf688b650a) [Doogal Simpson](https://hashnode.com/@doogal) · [Oct 10](https://hashnode.com/posts/preventing-timing-attacks-constant-time-comparison/6aca0b2cf3243977e5a0cbed) ### [Preventing Timing Attacks with Constant-Time Comparisons](https://doogal.dev/preventing-timing-attacks-constant-time-comparison?utm_source=hashnode&utm_medium=feed) Learn how standard string comparisons leak API keys and how to use constant-time comparison functions to secure your Node.js, Python, and Go applications. 5 min read · [doogal.dev](https://doogal.dev/preventing-timing-attacks-constant-time-comparison?utm_source=hashnode&utm_medium=feed) [Doogal Simpson](https://hashnode.com/@doogal) · [Oct 5](https://hashnode.com/posts/how-java-hashmap-prevents-hash-collision-dos/6ac3c87b4bf2dc0b3ea2ba1a) ### [How Java HashMap Prevents Hash Collision DoS Attacks](https://doogal.dev/how-java-hashmap-prevents-hash-collision-dos?utm_source=hashnode&utm_medium=feed) Learn how Java's HashMap mitigates Hash Collision DoS attacks using treeification to reduce lookup complexity from O(N) to O(log N). 5 min read · [doogal.dev](https://doogal.dev/how-java-hashmap-prevents-hash-collision-dos?utm_source=hashnode&utm_medium=feed) [Lewis Gilchrist](https://hashnode.com/@lewis-dev) · [Oct 1](https://hashnode.com/posts/captcha-cant-stop-sybil-attacks-proof-of-human-can/6abdeaf5b712493925002e32) ### [The bot problem that CAPTCHA can't solve, and proof of human can](https://devabkk.hashnode.dev/captcha-cant-stop-sybil-attacks-proof-of-human-can?utm_source=hashnode&utm_medium=feed) reCAPTCHA asks if you look human. Proof of human asks if you're unique. Different questions, different attack surfaces. Here's why it matters. 7 min read · [devabkk.hashnode.dev](https://devabkk.hashnode.dev/captcha-cant-stop-sybil-attacks-proof-of-human-can?utm_source=hashnode&utm_medium=feed) [Jebitok](https://hashnode.com/@w1t3r) · [Sep 22](https://hashnode.com/posts/http-request-smuggling-tryhackme/6ab23067c3008b3a30c5b743) ### [HTTP Request Smuggling (TryHackMe)](https://www.sharonjebitok.com/http-request-smuggling-tryhackme?utm_source=hashnode&utm_medium=feed) Link to the challenge on TryHackMe: HTTP Request Smuggling Introduction Introduction HTTP Request Smuggling is a vulnerability that arises when there are mismatches in different web infrastructure com 20 min read · [sharonjebitok.com](https://www.sharonjebitok.com/http-request-smuggling-tryhackme?utm_source=hashnode&utm_medium=feed)