application security
The Heap Notes
Hi, I'm Rafael. A slow blog about application security and the craft of shipping software. I write about SSRF, session management, least privilege and whatever else I'm learning this month.
Latest writing
- ·
Pinning Dependencies Is Not Optional Anymore
There is no shortage of articles about Vault. Most of them cover the happy path. This one is about what happened after the happy path ended.
#web#auth - ·
Security Reviews That Developers Don't Dread
There is no shortage of articles about Burp Suite. Most of them cover the happy path. This one is about what happened after the happy path ended.
#devsecops#auth#appsec - ·
Threat Modeling in Thirty Minutes
This post started as a note to my future self. Every few months I relearn the same lessons about threat modeling, so this time I'm writing them down.
#supply-chain#web - ·
Signing Container Images With Sigstore
This post started as a note to my future self. Every few months I relearn the same lessons about least privilege, so this time I'm writing them down.
#web#supply-chain - ·
Rotating Secrets Without a Maintenance Window
For a long time I treated session management as something to worry about later. Then a small change to our Semgrep setup turned into a week of debugging, and "later" arrived all at once.
#infosec#auth - ·
Session Cookies Done Right
There is no shortage of articles about Wireshark. Most of them cover the happy path. This one is about what happened after the happy path ended.
#web#security - ·
Least Privilege for Humans, Not Just Services
I've been working with Burp Suite for about 3 years now, and my opinions on least privilege have changed more than I expected.
#web#supply-chain#security - ·
SSRF Explained Through Real-World Mistakes
This post started as a note to my future self. Every few months I relearn the same lessons about SSRF, so this time I'm writing them down.
#privacy#web - ·
What a Leaked API Key Taught Our Team
Every codebase has one area everyone is a little afraid to touch. On our team, it was everything related to supply chain security.
#supply-chain#auth - ·
Your Content Security Policy Is Probably Too Loose
Every codebase has one area everyone is a little afraid to touch. On our team, it was everything related to content security policy.
#auth#infosec