Showing 1–12 of 32 articles
Page 1 of 3
Check who is allowed to call your webhook
A webhook’s payload and familiar endpoint name do not prove who sent it. Validate the sender using its supported scheme, handle retries deliberately, and authorize the resulting business action.
Read the visual guide
Do not put a secret API key inside a mobile app
An application you distribute to users cannot reliably hide a shared secret embedded in its code or resources. Put privileged authorization behind an appropriate server-side boundary.
Read the visual guide
What a security finding should contain
A useful finding gives its owner enough information to understand and verify the problem. Identify the affected asset, safe evidence, practical consequence, and a correction with a clear completion test.
Read the visual guide
What to check after you turn DMARC on
Publishing a DMARC record starts an ongoing process. Verify legitimate mail streams, review alignment failures, and make onboarding new senders part of normal change control.
Read the visual guide
Secure defaults people will leave switched on
A protective default is effective when people can complete real work without disabling it. Build a usable route for legitimate exceptions and test the resulting behavior.
Read the visual guide
Tabletop exercises that force a real decision
An exercise becomes useful when participants must make a real choice with limited information. Design the scenario around that choice, then capture what authority, evidence, and dependencies it exposes.
Read the visual guide
How to run vulnerability management as a queue
A vulnerability queue needs clear ownership, prioritization, and a way to establish closure. Ticket counts matter less than whether important exposure is actually reduced.
Read the visual guide
What to do with a software bill of materials
A software bill of materials lists components in a product or release. Its value comes from matching that inventory to deployed systems, relevant advisories, owners, and update decisions.
Read the visual guide
When your system acts with the wrong person’s authority
A service may have more access than the person asking it to act. It must check the caller’s authority before using its own powerful identity on that person’s behalf.
Read the visual guide
How a small organisation should give volunteers access
Volunteers need access that fits their actual work, including a clear owner and a defined review point. Shared accounts and indefinite permissions make changes harder to control.
Read the visual guide
How to write a privacy notice people can finish reading
A readable privacy notice starts with the real processing, not a template. Explain who handles information, why, with whom it is shared, how long it is kept, and how people can make requests.
Read the visual guide
Account recovery that can walk around the second check
Strong sign-in protection can be undermined by a weaker recovery process. Review every way to regain access, including support-assisted changes and replacement recovery details.
Read the visual guide