Systems & architecture
12 posts tagged #security on DiCodeWeb, from fundamentals to production, newest first.
12 postsUpdated Oct 31, 2026
What counts as a secret, how .env files and long-lived CI tokens actually leak, what to do in the first hour after a leak, secret stores compared, GitHub Actions OIDC to AWS and GCP instead of static keys, rotation without downtime, and typed env validation in a Turborepo monorepo.
Link previews, webhooks, image import and file uploads look like boring features, yet they keep showing up in incident reports. Why SSRF blocklists fail, a safe fetch in Node with undici and pinned IPs, IMDSv2, and an upload pipeline: presigned S3, magic bytes, sharp, a separate domain and async scanning.
The browser's cross-origin model from the ground up: what the Same-Origin Policy blocks, what CORS relaxes and what it never protects, preflights and credentials, Vary: Origin caching bugs, dangerous allowlists, then CORP, COEP, COOP, Fetch Metadata and SameSite — with NestJS and Next.js configs done right.
A practical threat model for applications that put an LLM between tools and private data: direct and indirect prompt injection, the lethal trifecta, and the design patterns that keep the damage contained, mapped against the OWASP Top 10 for LLM Applications.
All ten risks of the OWASP API Security Top 10 (2023) worked through in NestJS: ownership checks in scoped repositories, whitelisted DTOs, response shaping, CASL policies, cost-based rate limits, idempotent business flows, SSRF-safe fetch, and an authorization matrix in e2e tests.
How JWS differs from JWE, the claims you must check, alg: none, RS256/HS256 confusion, kid injection, jku abuse — and how to pin algorithms with jose, rotate JWKS keys without logging anyone out, revoke tokens, and test your verifier with the malicious tokens attackers will actually send.
Every HTTP request of the authorization code + PKCE flow, what state, nonce, ID tokens and access tokens each protect, why the implicit flow is dead, and how to build a Backend-for-Frontend in Next.js so tokens never reach the browser — plus refresh rotation, logout and the bugs I've actually seen.
How I run practical threat modeling with a product team: the four questions, a data flow diagram with trust boundaries, STRIDE per element on a real system with an SPA, API, Postgres, S3 uploads, a payment webhook and an admin panel, simple risk rating, threats turned into tickets, and a threat model that lives in the repo.
An honest authentication design for a NestJS API and a Next.js frontend: when to use sessions, when to use JWT, how to rotate refresh tokens with reuse detection, passkey sign-in with SimpleWebAuthn, and the guards, rate limits and CSRF protection that go with it.
Where coding agents genuinely help a frontend team and where they quietly fail, how to give them context with AGENTS.md and small tasks, plan-then-implement, verification loops, reviewing AI-generated PRs, supply-chain risks like slopsquatting, and which skills matter more now for mid and senior engineers.
From Nx s1ngularity and chalk/debug to Shai-Hulud, TanStack and ChainDrop: what the npm attacks actually did, what npm and GitHub changed, and a layered defense — install, CI, publish — applied directly to a Bun + Turborepo monorepo.
React's escaping does a lot for you, but not everything. This post walks through the XSS holes React doesn't cover, building a strict nonce-based CSP in Next.js, Trusted Types, CSRF in the SameSite era, where to store tokens, and how to stop clickjacking.