application security
Quiet Signal
Hi, I'm Kenji. A slow blog about application security and the craft of shipping software. I write about content security policy, SSRF, threat modeling and whatever else I'm learning this month.
Latest writing
- ·
SSRF Explained Through Real-World Mistakes
For a long time I treated SSRF as something to worry about later. Then a small change to our Burp Suite setup turned into a week of debugging, and "later" arrived all at once.
#supply-chain#security#web - ·
Least Privilege for Humans, Not Just Services
This post started as a note to my future self. Every few months I relearn the same lessons about least privilege, so this time I'm writing them down.
#auth#web#privacy - ·
Security Reviews That Developers Don't Dread
Every codebase has one area everyone is a little afraid to touch. On our team, it was everything related to least privilege.
#security#devsecops - ·
Session Cookies Done Right
This post started as a note to my future self. Every few months I relearn the same lessons about supply chain security, so this time I'm writing them down.
#supply-chain#auth#appsec - ·
Signing Container Images With Sigstore
This post started as a note to my future self. Every few months I relearn the same lessons about dependency pinning, so this time I'm writing them down.
#supply-chain#security#infosec - ·
Rotating Secrets Without a Maintenance Window
A colleague asked me last week why our team cares so much about threat modeling. I gave a rambling answer, so here is the longer, more organized version.
#infosec#devsecops - ·
Threat Modeling in Thirty Minutes
There is no shortage of articles about OWASP ZAP. Most of them cover the happy path. This one is about what happened after the happy path ended.
#devsecops#security - ·
What a Leaked API Key Taught Our Team
A colleague asked me last week why our team cares so much about least privilege. I gave a rambling answer, so here is the longer, more organized version.
#infosec#privacy#appsec