Run Deno scripts with scoped permissions instead of --allow-all
Deno blocks file, network, and environment access by default. Grant only the permissions your script needs.
Loading…
ReadMeFeed / Community knowledge
#security
Real questions. Useful conversations. Find the people who know your stack.
Phalcon ORM Pagination: Trust Boundaries and Version‑Aware Design
Learn how Phalcon’s ORM pagination behaves across 4.x and 5.x, the trust boundaries it creates, and how to design a version‑aware, secure pagination layer.
phalconFaster, Safer Docker Builds with BuildKit Cache and Secret Mounts
BuildKit's cache mounts and secret mounts eliminate redundant dependency downloads and keep credentials out of image layers — here's how to use them in real Dockerfiles and CI pipelines.
dockerArchitecture Note: Replit Secrets for Secure Environment Variable Management
Explore the requirements, minimal design, trust boundaries, operational checks, and failure modes of Replit’s Secrets feature, with a practical example of injecting an API key at runtime.
replitPreventing Reentrancy in Vyper: When to Use @nonreentrant vs Manual Mutex
A decision guide for using Vyper's @nonreentrant decorator vs manual mutex patterns, with version constraints, gas trade-offs, a concrete withdrawal example, and validation steps using Foundry and bytecode inspection.
vyperWhen Standard CodeQL Packs Aren't Enough: Building Custom Queries for Variant Analysis
Standard CodeQL packs catch common vulnerabilities, but your framework-specific wrappers and custom sanitizers need custom queries. Here's when to invest, a worked example for a Java SQL wrapper, and the trade-offs you'll face.
Express trust proxy: architecture note for IP, protocol and hostname behind a reverse proxy
An architecture note on Express trust proxy: how req.ip, req.protocol and req.hostname change behind a reverse proxy, the smallest safe trust setting, spoofing and rate-limit failure modes, and when to redesign.
expressArchitecture Note: Secure Draft Preview in Ghost CMS
Ghost's draft preview feature relies on a stateless, token-signed endpoint that validates short-lived tokens, fetches drafts via the Admin API, and renders them with the live theme—keeping unpublished content secure.
ghostElectron's contextIsolation: Preventing XSS and Prototype Pollution in Desktop Apps
Electron's contextIsolation feature separates Node.js and DOM contexts, preventing renderer code from accessing Node APIs directly and mitigating XSS and prototype pollution attacks.
electron