56,306 questions
Best practices
0
votes
1
replies
42
views
Securely managing JWTs in Next.js App Router: Middleware vs. Server Actions vs. Client-side storage?
I am developing a Next.js (App Router) application and I'm looking for the current "best practice" for storing user session tokens (JWTs).
Given the server-client hybrid nature of Next.js, I ...
Advice
0
votes
2
replies
63
views
How to rate limit unauthenticated users?
In the context of client side session management when user authenticates herself, she gets a token that is specific to her. When we get that token at the server side we are sure that token relates to ...
- 103
Advice
0
votes
1
replies
55
views
CIS Postgres 15 Benchmarks - log_replication_commands
As an action of our last test my company implemented log_replication_commands to 'log all replication commands that are executed in your database cluster to ensure the data is not off-loaded to an ...
0
votes
1
answer
45
views
WDAC not allowing self-signed .exe to run [closed]
I have a PC with WDAC (aka App Control for Business) correctly deployed. It functions as expected. However, I can't get a self-signed .exe to execute.
My policy has this:
<Signer ID="...
- 178
0
votes
1
answer
113
views
How do I inspect the Git history of someone else's repository, when the directory is not, in fact, "safe"?
Git somewhat recently added a security feature where the developers apparently decided that doing any Git operations safely when the contents of the .git directory are not trusted is out of scope for ...
- 3,035
Tooling
0
votes
4
replies
139
views
Best way to store accessToken and refreshToken in cookies
I’m currently using cookies for authentication in a .NET 9 backend with an Angular 20 frontend. Right now, I store both the accessToken and refreshToken directly in cookies.
I’m trying to improve the ...
Advice
1
vote
2
replies
90
views
Learning Claude
I am new to this field, and I’m hoping to learn with your help. That’s why I would like to ask a few questions regarding AI and using Claude for coding.
At the moment, I am trying to build an app with ...
Advice
0
votes
1
replies
64
views
P2P secure network
“What are the most critical design decisions and trade-offs when building a secure P2P network from scratch, and what mistakes should I avoid based on existing systems?”
“What would make users ...
- 1
Advice
0
votes
0
replies
101
views
Best way to organize a technical reference repository for backend and DevOps
I’m a junior backend developer and I’ve created a technical reference repository with resources related to backend development, DevOps, and security: https://github.com/Rub3cK0r3/engineering-reference
...
Best practices
0
votes
5
replies
74
views
Are Enviornment Variables Still Considered a Secure Choice for Production?
I am hosting my Django website, and I am very concerned about security measures and implementations. However, I feel like system environment variables saved in servers (in my example I am using Koyeb) ...
- 341
Best practices
0
votes
0
replies
83
views
FIrebase + expo+biometrie auth persistance
I am looking to implement an efficient and secure solution to manage authentication persistence in a mobile application, while also allowing the use of biometrics to simplify user re-authentication.
...
- 1
-1
votes
0
answers
93
views
CFP RCTX instruciton for invalidating the BPU on aarch64
I am running on a Neoverse-N3 (AArch64) CPU and attempting to invalidate or separate the Branch Prediction Unit (BPU) between different pieces of code as part of an experiment.
The code runs inside a ...
Best practices
3
votes
0
replies
185
views
Is it safe to use `git config --global credential.helper store` on Claude Code?
The convenience of not having to type your git credentials multiple times is traded with a higher exposure to running git commands you wouldn't have consented to if you were woke coding (vs. vibe ...
- 583
Best practices
3
votes
0
replies
42
views
How can i make my telegram bot get into Groups
I'm building a Telegram bot using python-telegram-bot (v20+) that needs to:
Join or be added to multiple Telegram groups focused on cybersecurity (threat intel, hacking tutorials, CVE discussions, ...
Advice
0
votes
1
replies
104
views
Can client application be strict FIPS compliant (FIPS 140-3)?
I’m looking into understanding FIPS 140-3 compliance of following clients:
Java clients using BouncyCastle FIPS Provider and BouncyCastleJSSE Provider
Openssl client using OpenSSL fips provider.
In ...
- 41