📰 Dev.to · Max

Last week I downloaded a CLI release and saw the familiar pair of links: a binary and its SHA256SUMS...

Most JWT bugs aren't cryptographic — you catch them by reading the token. How I decode JWTs offline to spot alg:none, HS256/RS256 confusion, and leaked PII.

How webhook HMAC-SHA256 signatures work, the three bugs that silently break your verification, and how to check one by hand when a delivery fails.

Every JPEG your phone takes can carry the exact GPS coordinates of where you stood. Post a few...

A friend sent me a photo of their new apartment and asked me to guess the neighborhood. I opened the...

How HIBP's k-anonymity range API lets you check a password against 900M+ breached credentials without ever sending the password or its full hash. Real bytes on

Last month I watched a teammate debug an auth bug by pasting a production JWT into the first "base64...

Math.random() passwords are crackable from 64-128 outputs. crypto.getRandomValues() fixes it - plus the modulo-bias and 64KB quota gotchas that bite DIY fixes.

Server-side dev tools quietly POST whatever you paste — including credentials — to a backend. Here's the threat model, and a 2-minute way to verify any tool is

Last month I ran trufflehog against one of my private repos — a homelab automation project I’d never...

Set up TrueNAS with enterprise-grade security in your homelab. Covers ZFS encryption, firewalls, VPNs, access controls, and backup strategies.

Ngrok is one of those tools that's dangerously easy to love. Spin up a tunnel, get a public URL,...

Set up Plex on TrueNAS with enterprise-grade security. Covers ZFS datasets, ACLs, VLAN isolation, reverse proxy, and ongoing maintenance for your homelab.

Stop paying for VPNs. Cloudflare WARP gives you instant WireGuard encryption, and Cloudflare Tunnel + Zero Trust replaces your homelab VPN — no open ports, no d

Enforce PSS restricted on all production namespaces. A practical migration path from warn to enforce mode, with real incident examples and CI integration.

How Canvas API, AudioContext, and WebGL fingerprint your browser without cookies. Code examples, entropy measurements, and what actually defends against it.

CVE-2026-3055 is a CVSS 9.3 memory overread in Citrix NetScaler ADC and Gateway. Attackers are stealing admin session tokens via crafted SAML requests. Here's w

My source code leaked last week. Well — not my source code. Claude Code's. The terminal I run...

A file download command failed on accented filenames. I blamed GitLab. I blamed the URL encoder. I...

The error made no sense: “Cannot find module ‘./dist/index.js’. Please verify that the package.json...

CVE-2025-53521 dropped into CISA’s Known Exploited Vulnerabilities catalog on March 27, and the...

Explore a production-proven, security-first approach to Kubernetes supply chain security using SBOMs...