56,298 questions
Tooling
0
votes
0
replies
20
views
What methods can I use to provide an upload page on a static (github pages) website?
I have a project that is currently in github pages (and will change to codeberg sometime this year) and we want to invite collaborators of all backgrounds. This means a lot might not have a github/...
- 41
Advice
0
votes
2
replies
52
views
TensorFlow models DoS via input-controlled tensor sizes?
Running untrusted TensorFlow models and noticed this:
import tensorflow as tf
import time
class TestLayer(tf.keras.layers.Layer):
def call(self, inputs):
n = tf.cast(inputs[0][0], tf....
Advice
0
votes
0
replies
28
views
Recommendations to reduce the risk of Supply Chain Attakcs
Rewind to 2024, CVE-2024-3094 is discovered. Quoting cve.org for brevity,
Malicious code was discovered in the upstream tarballs of xz. ... that can be used by any software linked against this ...
- 1
Advice
1
vote
2
replies
115
views
What is the best career path in programming in 2026?
I am a beginner in programming and I want to choose a good career path.
I am considering Full Stack Development, AI/ML, and Cyber Security.
I want to know which one is most suitable and has good ...
Advice
0
votes
0
replies
34
views
How to secure a Node.js API for a smart home security system?
I am working on a smart home security system using Node.js where devices like cameras and sensors send data to an API.
I want to make sure the API is secure and protected from unauthorized access. ...
Advice
1
vote
1
replies
85
views
How does Netflix authentication work (with focus on device detection + IP range based detection)?
I'm trying to understand how large-scale authentication systems (like Netflix) implement user verification. Specifically, how are devices detected and classified (trusted vs new), and how are IP ...
Best practices
1
vote
3
replies
63
views
Are there security issues with using responseXML property of XMLHttpRequest?
I am writing JavaScript code that runs in a web browser, retrieves a user-supplied XML file, and gets certain information out of it. I know that XML parsing is a potentially dangerous operation if the ...
- 563
3
votes
1
answer
103
views
Cycode scan recommends HTML sanitization for iframe.src assignment, but I'm only using a URL—what is the proper mitigation?
We have the following code in our Angular application:
const auth_token = sessionStorage.getItem('auth_token') ||
this.sessionStorage.retrieve('authenticationtoken') ||
...
Tooling
0
votes
3
replies
128
views
How to create a simple phishing detection and awareness system
I am a beginner student working on a mini project about a "Phishing Detection and Awareness System".
I want to create a simple system that can:
- Check whether a URL is safe or suspicious
- ...
Advice
0
votes
1
replies
213
views
How to implement real-time file scanning with FastAPI and background workers?
I’m building a cybersecurity tool (antivirus-style system) that scans files and detects malicious behavior.
Current setup:
- Backend: FastAPI
- Frontend: React (Vite)
- Features implemented:
File ...
- 1
Tooling
0
votes
0
replies
40
views
Recommended open‑source tools for Cryptographic Bill of Materials (CBOM) generation, scanning, and reporting
I am looking to implement a Cryptographic Bill of Materials (CBOM) as part of our security and compliance initiative. What open‑source tools are currently recommended for CBOM generation or crypto ...
4
votes
1
answer
149
views
What does this comment in the PHPMyAdmin source code mean?
I have been researching security related topics and I looked at the source code of phpMyAdmin to see how things are done in a well-established application.
I checked out the code in the "PATH\...
- 287
Best practices
0
votes
1
replies
59
views
How to handle authentication securely in a web app?
Building a web application and want to implement authentication in a secure and scalable way. I understand the basics of login/signup flows, but I’m unsure about best practices for handling ...
4
votes
3
answers
196
views
Do TOCTOU vulnerabilities exist in file *existence* checks with access()?
Reading up about time-of-check to time-of-use (TOCTOU) vulnerabilities, I've seen the access() function referenced multiple times in examples of such vulnerabilities. The typical case being where it ...
- 43
Best practices
0
votes
1
replies
55
views
Securely managing JWTs in Next.js App Router: Middleware vs. Server Actions vs. Client-side storage?
I am developing a Next.js (App Router) application and I'm looking for the current "best practice" for storing user session tokens (JWTs).
Given the server-client hybrid nature of Next.js, I ...
