security

I need to handle webhooks from multiple providers (Stripe, GitHub, custom services). I need a reusable pattern for signature verification, idempotent processing, and handling duplicate deliveries.

I need API key authentication for my FastAPI service. API keys must be stored securely (not plaintext), validated on every request, and I want to support multiple keys per user with revocation.

I am building a multi-tenant SaaS where each user should only see their own data. I want PostgreSQL row-level security (RLS) policies to enforce data isolation at the database level.

CI/CD pipeline needs secrets (API keys, deployment credentials) for different environments. Using repository-level secrets means production keys are accessible in all workflows including untrusted PRs...

Python's site-packages mechanism executes any line starting with `import` in a *.pth file at interpreter startup, before user code runs. The compromised litellm 1.82.7/1.82.8 (PyPI, ~40 min live, 2026...

PyJWT 2.10+ added InsecureKeyLengthWarning in jwt/api_jwt.py that fires when the HMAC key used with HS256 is shorter than 32 bytes (256-bit hash output), per RFC 7518 Section 3.2. The check is byte-le...

Some OAuth providers (e.g. HubSpot's `/oauth/v1/access-tokens/{access_token}` introspection endpoint) carry the bearer token in the URL path rather than an Authorization header. When the request fails...

In optimistic-concurrency flows that use conditional UpdateItem for one-time token/state consumption, a subsequent default (eventually consistent) GetItem can lag and misclassify failures under conten...

Most recent npm/PyPI compromises were detected and yanked within hours: debug+chalk (~2h live, 2025-09), litellm (~40min, 2026-03), axios (~3h, 2026-04), lottie-player (~2h, 2024-10), ua-parser-js (~4...

Lockfiles (package-lock.json, pnpm-lock.yaml, uv.lock) record the hash of whatever version `install` first saw. If a maintainer-account compromise publishes a new bad version, the next fresh install, ...

Action tags are git tags and can be silently retargeted. A compromised maintainer can repoint @v4 at a malicious commit and every consumer pulls it on the next run. GitHub added an org/enterprise poli...

Unlike `pull_request`, `pull_request_target` runs against the base branch with the target repository's secrets available, while PR-author-controlled fields (title, body, branch name, head ref) feed in...

In pnpm projects with an existing lockfile, `pnpm install --lockfile-only` preserves already-pinned transitive versions even when newer patched versions satisfy semver ranges. To remediate advisories ...

`GET https://api.hubapi.com/oauth/v1/access-tokens/{access_token}` carries the bearer token as a URL path segment, not in an `Authorization` header. Standard HTTP error handling (e.g. `httpx.HTTPStatu...