Posted in未分类
The Regex That Hangs Your Server at 3 a.m. — A Pre-Commit Guide
Five catastrophic-backtracking categories, four mechanical rewrites, and a 60-second pre-commit check that beats every ReDoS post-mortem.
Posted in未分类
Security Headers Checker: A+ to F Grade in 30 Seconds
Audit HTTP response headers for OWASP security compliance. Paste raw headers from curl, DevTools, or CI — get a letter grade with copy-ready fixes for HSTS, CSP, X-Content-Type-Options, COOP/COEP/CORP, and nine more.
Posted in未分类
Why Your Password Hash Is the Wrong Defense (and How Bcrypt Closes the Gap)
Bcrypt has held the password-storage line for twenty-five years. Here is the algorithm, the cost knob, and the four things that fail when teams wire it in.
Posted in未分类
AES Encryption Tool: The Three Decisions That Decide Whether Your AES Encryption Is Real Encryption
AES-256 is the easy part. The three decisions that decide whether your AES encryption is real encryption are mode of operation, key derivation, and output framing.
Posted in未分类
8 Patterns That Make an XSS String
The eight patterns that make an XSS string Cross-site scripting has the same fingerprint every…
Posted in未分类
The three segments of a JWT are the only thing standing between an attacker and your API
A JWT looks like one opaque string. It isn't. It is a public header, a…
Posted in未分类
The four numbers that decide whether your Scrypt hash will outlast a GPU farm
Scrypt is the password hash you reach for when PBKDF2 isn't enough, and the most…
Posted in未分类
SQL Injection Detector: The Five Strings Your WAF Almost Misses
You don’t need an exotic payload to get past most WAFs. You need a string…
Posted in未分类
The Hidden Serial Number in Your PDF That Tells You Exactly Who Leaked It
Every recipient gets a different copy. Every copy carries an invisible serial. Every serial maps back to one name.
Posted in未分类
The Three Mistakes in Every JWT Generator That Make Your Tokens Forgeable
The Three Mistakes in Every JWT Generator That Make Your Tokens Forgeable Most JWT generator…