Check who is allowed to call your webhook
A webhook’s payload and familiar endpoint name do not prove who sent it. Validate the sender using its supported scheme, handle retries deliberately, and authorize the resulting business action.
Security Guides
Security Guides
Do not put a secret API key inside a mobile app
An application you distribute to users cannot reliably hide a shared secret embedded in its code or resources. Put privileged authorization behind an appropriate server-side boundary.
What a security finding should contain
A useful finding gives its owner enough information to understand and verify the problem. Identify the affected asset, safe evidence, practical consequence, and a correction with a clear completion test.
What to check after you turn DMARC on
Publishing a DMARC record starts an ongoing process. Verify legitimate mail streams, review alignment failures, and make onboarding new senders part of normal change control.
Secure defaults people will leave switched on
A protective default is effective when people can complete real work without disabling it. Build a usable route for legitimate exceptions and test the resulting behavior.
Tabletop exercises that force a real decision
An exercise becomes useful when participants must make a real choice with limited information. Design the scenario around that choice, then capture what authority, evidence, and dependencies it exposes.
How to run vulnerability management as a queue
A vulnerability queue needs clear ownership, prioritization, and a way to establish closure. Ticket counts matter less than whether important exposure is actually reduced.
What to do with a software bill of materials
A software bill of materials lists components in a product or release. Its value comes from matching that inventory to deployed systems, relevant advisories, owners, and update decisions.
When your system acts with the wrong person’s authority
A service may have more access than the person asking it to act. It must check the caller’s authority before using its own powerful identity on that person’s behalf.
How a small organisation should give volunteers access
Volunteers need access that fits their actual work, including a clear owner and a defined review point. Shared accounts and indefinite permissions make changes harder to control.