Blog

Research articles and blog posts from SecDim

Tl;dr : This article is analysis of over 50 submissions for a JavaScript integer overflow challenge. Many submissions did not...

Tl;dr : The input was not checked for out of range values. By enforcing size change on the data type,...

Tl;dr: Authentication alone could only hide API security weaknesses. Three security controls are required to address the root cause of...

Suppose the following function checks if a user can access a resource. What can go wrong? function checkAccess(User user, Resource...

We all know secret keys, passwords, API keys, tokens, payment card data (pin, pan, track2 data, cvv) should never be...

These submission fail for a good reason. The security vulnerability has not been fixed! Let’s find out why. uint is...

Over 6 hours of practical AppSec & DevSecOps video workshops This is summary of our live recording from Jan to...

Kubernetes Pod is insecure by default and It runs as root. This security misconfiguration can lead to arbitrary code execution....

Running a container as a root is dangerous. But why? Let’s first understand what is the difference between running a...