Application security

The flaws that come from how software is written, not how it is deployed.

34 sketches

• IDOR/BOLAA different number, someone else's bag
• SASTIt reads every page and runs none
• SQL injectionInput that finishes your sentence
• SSRFGetting the building to fetch it
• Broken access controlTaking the button away is not a no
• Business logic abuseEvery step allowed, the whole thing wrong
• Code reviewPeople review what rules cannot say
• Cross-site scriptingTheir script, your browser, the site's privileges
• Dependency confusionThe points decide what gets built
• FuzzingFeed it nonsense until something gives
• InjectionData read as an instruction
• Insecure designThe control nobody ever asked for
• Mass assignmentWhatever arrives goes on the record
• Resource exhaustionA small tap on a very large pipe
• Secure codingFaultless code, leaking system
• Security misconfigurationSound equipment, shipped as it stands
• Security testingFour tests, four questions
• Vulnerable dependenciesEverything upstream arrives with it
• CSRF abuses an authenticated browserTheir note, your session
• XSS turns trusted pages into script deliveryIt comes out in your own voice
• Output encoding is context-specificThe plug has to match the socket
• Path traversal escapes the intended file areaTwo dots at a time
• File upload security is more than extension checkingThe label is a claim, not a check
• Open redirects lend trusted domains to phishingYour livery, their destination
• Security headers shape browser behaviourInstructions the browser follows
• Threat modelling asks how a design can fail before code existsBreak it on paper first
• Input validation defines what the application acceptsOne shape fits
• Security requirements are product requirementsThey go on the same sheet
• Code review and automated scanning see different risksThe magnet and the eye
• Security tests should exercise abuse casesThe load nobody specified
• Feature flags can become security statesSomebody left it up
• Error handling should fail predictablyBreak the same way every time
• Dependency updates are part of developmentIt rides the same belt
• Security debt compounds through dependenciesIt grows into everything above it