Even if you follow security best practices and choose bcrypt for password hashing you can still get it wrong. How does Bun handle it in a more secure fashion? What happened with the Okta bcrypt incident? Lets dive in.

How about a more offensive side of security? Check out a NodeJS path traversal vulnerability scanner.

Stop storing secrets in environment variables. It's a bad practice and only fits hobby or side projects with no real business impact. Here are all the reasons why you should never store secrets in environment variables and how to do it better.

Getting started with the npm audit command and learn why it's not enough and how to advance your project's security posture with more robust security tools like Snyk.

Better some security than none at all. If you're using Yarn package manager, learn about `yarn audit` and how to use it to check for vulnerabilities in your dependencies.

Have I gone mad? Do I actually recommend not using an ORM and actually gaining a security advantage? Sort of. It's more nuanced but if we're trying to fix SQL injection and related vulnerabilities then I invite you to take a read.

Briefly exploring core concepts around Node API security with regards to GraphQL and REST API design with code examples specific to Node.js application servers.

Briefly exploring the Node.js threat model to draw some opinions on whether Node.js is secure or not.

Are you using regex to validate URLs? Learn from a CVE identified in the node-forge npm package that was using a regex pattern to validate URLs and resulted in a security vulnerability.

Learn how I discovered a Node.js core prototype pollution regression, its security implications, and why it didn't warrant a CVE. Luckily, I also fixed it for us!

A recent security issue in the Deno CLI (CVE-2024-37150) highlights the importance of secure credential handling. Learn how this vulnerability mirrors past npm CLI mistakes and what you can do to stay secure.

JavaScript developers need security skills to safeguard user data, prevent application breaches, and maintain user trust. Learn about essential security skills for writing secure code and fixing vulnerabilities in JavaScript applications.

Learn about Prototype Pollution in Node.js: what it is, how it works, and how to prevent it. Includes real-world examples and security best practices for developers.

Sasha shares how they inadvertently wrote a React Server Component code that would have resulted in a security breach, if not refactored in time to fix the issue. What can we learn and how to avoid security risks that developers easily repeat, especially as it blurs the line between client-side and server-side React code.

Interestingly enough, the IDOR vulnerability type is found as a CVE more commonly in some languages rather than others. Why is that and how can you prevent it?

The most upvoted Reddit answer to a question about serving images via a route in Express.js is a security vulnerability waiting to happen.

Are we going to settle the debate between raw SQL queries and ORMs once and for all? Let's explore the pros and cons of each approach and find the right balance between control and convenience.

Enhance your development workflow with JavaScript security best practices. Learn about Content Security Policy (CSP) in Nuxt.js, avoiding `eval` and `new Function` with untrusted input, secure DOM manipulation, cookie security, and third-party integration.

Path traversal vulnerabilities were discovered in webpack and backstage npm packages. Learn secure coding practices to prevent path traversal attacks in Node.js applications.

Secure JavaScript coding practices are essential to prevent command injection vulnerabilities in Node.js applications. Learn how to avoid common pitfalls and protect your code from exploitation.

Can you spot an Insecure Direct Object Reference (IDOR) vulnerability in your JavaScript application? Learn what IDOR is, how it can be exploited, and how to prevent it in your code.

Learn about recent npm vulnerabilities in popular npm packages and how to protect your applications from security reports disclosed in 2024.

A project fork is not without risks, and this time it's the safe-eval-2 npm package that is vulnerable to code injection attacks.

Learn how to secure your Node.js applications with the new Permissions Model, stay informed about security releases, and understand the Node.js Security Threat.

Learn about common Node.js security issues and how to mitigate them. This blog post covers Denial-of-Service (DoS) attacks, DNS rebinding attacks, unintended package publication, information exposure via timing attacks, and command injection vulnerabilities.

The npm ecosystem is a minefield of security risks. How can JavaScript developers protect from these threats and adopt npm security best practices? Here's how.

The XZ backdoor CVE-2024-3094 already happened in JavaScript 5 years ago but now the xz and liblzma malware bundled onto Linux distributions is bringing forth a world-wide threatening event in cybersecurity that jeopardizes the trust, sustainability and security concerns in the open-source ecosystem.

Level up your Node.js security game! This guide explores essential best practices to safeguard your server-side code and build robust, secure applications.

How do you maintain Node.js secure configuration? Learn how to protect your Node.js applications from vulnerabilities and unauthorized access.

Node.js applications can be vulnerable to issues like command injection, path traversal, and insecure APIs. Learn how to avoid these common Node.js security pitfalls.

Building secure node.js applications starts with applying essential input validation best practices and techniques to prevent common security vulnerabilities.

Don't let vulnerabilities slow you down: Introducing is-my-node-vulnerable, the Node.js vulnerability scanner. Securing your Node.js applications in production is crucial. This blog post explores is-my-node-vulnerable, a free and easy-to-use scanner developed by Node.js expert Rafael Gonzaga.

Introducing JavaScript security issues in Node.js applications such as Cross-site Scripting (XSS) and Content Security Policy (CSP).

Properly implementing authentication and authorization is crucial for securing Node.js apps. This section covers guidelines like proper session management, password hashing, and attack prevention.

Learn how to secure Node.js applications with OWASP's comprehensive best practices guidelines and practical techniques for authentication, authorization, cryptography, input validation, and more.

Insecure direct object references (IDOR) are an important web application security concept that every developer should understand. IDOR vulnerabilities allow attackers to access unauthorized data and functionality by manipulating object identifiers used in web applications. In this post, I'll explain IDORs and provide examples to help you prevent these issues in your Node.js and JavaScript server-side applications.

North Korean state hackers compromise npm supply chain with malicious packages; crypto thieves exploit Ledger Connect kit library published to npm, stealing $600k before detected; incident highlights risks of uncontrolled open source usage and need for better validation, monitoring of third party code.

Learn best practices and strategies to identify and prevent command injection vulnerabilities in your JavaScript projects. Discover the power of secure code reviews, secure API usage, and Node.js-specific tips. Explore further with our book, 'Node.js Secure Coding: Defending Against Command Injection Vulnerabilities,' and fortify your skills.

Exploring the OWASP Top Ten list, and dissecting how Node.js applications can fall prey to command injection attacks. With practical insights, learn how to fortify your Node.js projects against this top security risk. Command injection may be no laughing matter, but this engaging exploration will have you smiling as you enhance your Node.js security expertise.

How do you identify vulnerable code patterns? Can you spot insufficient input validation? Enhance your Node.js development security with this guide to secure code review.

Let's explore a recently disclosed argument injection flaw in the popular 'blamer' npm package that allowed overwriting arbitrary files by exploiting the 'git blame' command. By passing unchecked user input directly to the Linux command, attackers could trigger damaging behavior.

This article explores real-world command injection vulnerabilities that have impacted popular applications, emphasizing the need for secure coding practices. We take you through the background of Node.js and its vast user base, setting the stage for understanding the gravity of command injection attacks.

Command injection vulnerabilities pose a significant threat to Node.js and JavaScript applications' security. By understanding the risks involved, referencing real-world incidents, and following best practices, developers can effectively mitigate these vulnerabilities. Remember, validating and sanitizing user input, utilizing command argument separation, and following the least privilege principle are essential steps toward creating secure applications.