Application Security for Developers
Secure code is
readable code.
Deep-dive guides on SQL injection, JWT attacks, supply chain security, and more. Code-forward. No fluff.
Featured
AI Coding Agent Hooks: A New Persistence Layer for Supply-Chain Malware
The npm worm behind the August 2026 keyv compromise doesn't just steal credentials at install time anymore — it commits malicious hooks into .claude/settings.json and .vscode/tasks.json so the payload re-executes every time a developer opens the repo. Here's how the technique works and how to detect and block it.
ChainDrop: How a Preinstall Hook Turned keyv and cacheable Into a Self-Propagating npm Worm
ChainDrop compromised keyv, cacheable, and 450+ downstream npm packages via a malicious preinstall hook. Here's how the worm propagated, what it stole, and how to lock down your install pipeline.
npm 12's allowScripts: Turning Install Scripts Into an Explicit Allowlist
npm 12 disables preinstall/install/postinstall lifecycle scripts, git dependencies, and remote tarballs by default. Here's how the new allowScripts allowlist works, how to migrate without breaking CI, and why it directly blocks the ChainDrop-style worm pattern.
SQL Injection Prevention: A Complete Developer Guide
Parameterised queries, ORM pitfalls, and blind SQLi detection patterns to protect your application data.
Cross-Site Scripting (XSS): Prevention Patterns for Modern Web Apps
Reflected, stored, and DOM-based XSS explained with real exploit chains and prevention patterns for JavaScript, React, Node.js, and Python.