4 articles tagged with "appsec"
You rolled out push-based MFA and called authentication solved. Then someone hammered a user with 50 approval prompts at 2 a.m. until they tapped 'Approve' just to make it stop. Here's why push MFA fails quietly, and how to build it so it doesn't.
Real threat modeling doesn't require a whiteboard workshop, a STRIDE certification, or four hours you don't have. Here's the stripped-down version that fits into a sprint and still catches the bug that would've paged you at 2am.
You're serving files. You're sanitizing inputs. You think you're safe. Then someone types ../../../../etc/passwd and your confidence evaporates. Path traversal is ancient, boring, and still quietly wrecking modern apps.
You trust your logs to tell the truth. But what if attackers are writing the story? Log injection lets hackers forge entries, hide attacks, and even trigger XSS in your log viewer — and most devs never see it coming.