The Logic Decode blog

Every article, one place

Tutorials, deep-dives, and the trends that actually matter — filter by topic below.

Browse the full archive of 218 articles →

All Python Web Dev AI & ML DevOps CS News

Supply chain: the attack you cannot code around

Why a vulnerability in someone else's dependency is still your production incident, and the concrete habits (lockfiles, audits, pinning) that limit the blast radius.

Sep 16, 20266 min

Web Dev

Secrets, env vars and the committed API key

Why a leaked API key isn't fixed by deleting it from the latest commit, how .env files actually protect you, and what to do the moment a secret leaks.

Sep 16, 20265 min

Web Dev

Broken access control and IDOR

Why returning 403 for someone else's resource is itself a leak, and why Linkstash returns 404 instead, with the real routes and requests to prove it.

Sep 15, 20266 min

Web Dev

Security headers and CSP: the free wins

What Content-Security-Policy, HSTS, and nosniff actually stop, why middleware order decides whether they apply at all, and where to add them in Express.

Sep 15, 20266 min

Web Dev

Breaking authentication

Credential stuffing, brute force, and the timing bug that leaks which emails have accounts, with the real fix from a login endpoint in production.

Sep 14, 20266 min

Web Dev

Why your password hash is not good enough

argon2id versus faster hashes, why a 12-character minimum beats complexity rules, and a real race condition in a signup endpoint under concurrent load.

Sep 14, 20266 min

Web Dev

CSRF: making the browser betray its user

How cross-site request forgery uses a browser's own cookie-sending rules to trigger actions a logged-in user never asked for, and how to actually stop it.

Sep 13, 20266 min

Web Dev

XSS: running your code on their page

How cross-site scripting turns a comment box into a way to run JavaScript on someone else's session, demonstrated live, then fixed with proper escaping.

Sep 13, 20266 min

Web Dev

SQL injection: break it live, then fix it

Run a real SQL injection against a real in-browser SQLite database, watch every row come back, then fix it the way Linkstash actually does.

Sep 12, 20266 min