Security
24 posts
Trusting X-Forwarded-For Is How Rate Limiting Quietly Stops Working
If you read the leftmost X-Forwarded-For value, the client picks its own identity and a rotating header defeats your limiter entirely. Count hops instead.
An RSS Reader Is an SSRF Machine
An RSS-to-email service fetches arbitrary URLs on a schedule, forever. How emit guards its feed fetcher, and the hole it can only mitigate.
Validate At the Lowest Public Boundary
A Python wrapper that validates its arguments is not validation if the C extension underneath is importable. Anything importable is public API.
Sentinel: Using MCP Sampling to Analyze Your Own Tool Security
Building an MCP server that uses sampling to discover your connected tools and analyze them for security risks, with no API keys required.
A Practical Guide to GitHub Branch Protection Rules
What each GitHub branch protection rule actually does, when to use it, and how to choose the right configuration for your project's size and risk profile.
Ruff vs Traditional Bandit - A Performance Comparison
Ruff is 25x faster than traditional Bandit. Here's what that performance difference means for your workflow and when to choose each tool.
Integrating Bandit into CI/CD Pipelines
How to add Bandit security scanning to your CI pipeline without breaking every build and making developers hate you forever.
Managing Bandit False Positives Without Breaking Security
How to handle false positives in Bandit without accidentally silencing the real vulnerabilities hiding among them. A practical guide.
Governance in AI Agent Security
Why prompt injection defenses keep failing and what enterprise AI deployments actually need to detect the lethal trifecta.
SQL Injection Detection with Bandit Rule B608: Beyond the Basics
Learn how Bandit's B608 rule detects SQL injection vulnerabilities in Python. Understand common patterns, secure alternatives, and defense strategies.