Security & Privacy Engineering

AppSec, threat modeling, SBOMs, secrets, SAST/DAST, authN/Z, and privacy by design.

  • 4 Subtopics
  • 14 Tracked terms
  • Last 30 days Feed window
Search within this topic Ask AI about this topic All topics

Inside Security & Privacy Engineering

AppSec & Code Scanning Static/dynamic analysis, dependency health, and secure coding patterns. Identity, Auth & Access OAuth/OIDC, SSO, policy engines, and permissions at scale. Secrets, Keys & SBOM Rotation, KMS/HSM, provenance, and SBOM generation/attestation. Privacy by Design Consent, retention, minimization, anonymization, and compliance-by-design.

What this topic collects on

An article joins this feed when it matches these terms. Each one is also a search of its own.

Latest in Security & Privacy Engineering


dev.to > learn-to-earn > vibe-coding-is-quietly-shipping-your-api-keys-to-github-2ha

Vibe Coding Is Quietly Shipping Your API Keys to GitHub

1+ hour, 32+ min ago   (410+ words) You asked the AI to "just get Stripe webhooks working." Thirty seconds later it did. The code ran, the test payment went through, and you pushed. What you may not have noticed is line 14: That is a live Stripe key, now…...


dev.to > lu1tr0n > oauth-20-que-es-y-como-funciona-la-delegacion-de-acceso-58l1

OAuth 2.0: qué es y cómo funciona la delegación de acceso

4+ hour, 32+ min ago   (1225+ words) Cada vez que tocás "Continuar con Google" en una app nueva y nunca escribís una contraseña, estás usando OAuth 2.0. El protocolo se formalizó en el RFC 6749 en octubre de 2012 y hoy sostiene casi todo inicio de sesión delegado de la…...


medium.com > @azusystech2023 > software-development-company-in-chennai-azusys-tech-a15a6efa7ffb

Software Development Company in Chennai | Azusys Tech

14+ hour, 1+ min ago   (872+ words) Looking for a software development company in Chennai? Azusys Technologies builds custom software, web apps, ERP and CRM solutions. Discuss your project today. Every business has a different challenge. A retail company may struggle with inventory records. A hospital may…...


habitualcs.io > post > entra-external-id-login-in-ionic-a-capacitor-msal-plugin-tutorial

Entra External ID Login in Ionic: A Capacitor MSAL Plugin Tutorial

21+ hour, 47+ min ago   (502+ words) Three details matter for mobile developers: Hand-rolled browser + PKCE This plugin (native MSAL) You choose and secure it (Preferences is not secure storage) Keychain on iOS, encrypted storage on Android, localStorage on web You implement refresh-token rotation and races Custom…...


dev.to > kozhevniko > a-refresh-token-with-no-expiry-is-a-password-that-does-not-get-rotated-3fin

A refresh token with no expiry is a password that does not get rotated

21+ hour, 44+ min ago   (567+ words) RFC 6749 defines both token types and leaves their lifetimes to the authorisation server. RFC 6819 discusses the consequences, including the fact that a refresh token is a long-lived credential that can be replayed to obtain new access tokens without further user…...


dev.to > thegdsks > theauth-guide-cap-agent-spend-and-require-human-approval-4c6l

theAuth Guide: Cap Agent Spend and Require Human Approval

22+ hour, 56+ min ago   (1785+ words) theAuth is open-source auth for AI agents and humans. Star the repo on GitHub · Read the docs · Run the quickstart · theauth.dev A planner agent of mine once fanned out to six workers on a Friday night. By Saturday morning…...


dev.to > thegdsks > theauth-passwordless-login-passkeys-magic-links-otp-46ol

theAuth Passwordless Login: Passkeys, Magic Links, OTP

22+ hour, 56+ min ago   (1844+ words) theAuth is open-source auth for AI agents and humans. Star the repo on GitHub · Read the docs · Run the quickstart · theauth.dev Last month I deleted a password reset email template from a side project. It felt strange. That template…...


dev.to > thegdsks > migrate-from-auth0-or-clerk-to-theauth-step-by-step-3dm5

Migrate from Auth0 or Clerk to theAuth, Step by Step

22+ hour, 56+ min ago   (1772+ words) theAuth is open-source auth for AI agents and humans. Star the repo on GitHub · Read the docs · Run the quickstart · theauth.dev Every auth migration I have seen goes wrong in the same place. The code diff is easy. The…...


linuxiac.com > over-half-a-million-credentials-leaked-on-github-remain-active

Over Half a Million Credentials Leaked on GitHub Remain Active

4+ day, 2+ hour ago   (569+ words) Truffle Security found 543,699 still-valid credentials across more than 224 million public GitHub repositories, including some exposed for over 16 years. Truffle Security has uncovered more than half a million credentials sitting in public GitHub repositories that were still valid when researchers tested…...


dev.to > tcandra24 > i-integrated-better-auth-into-nuxt-and-the-session-bugs-taught-me-more-than-i-expected-gjg

I Integrated Better Auth into Nuxt, and the Session Bugs Taught Me More Than I Expected

1+ day, 11+ hour ago   (1306+ words) When I started building my blog with Nuxt, I wanted to keep things simple. I needed an authentication system for the admin panel, so I could manage articles, categories, and other content without exposing those features to everyone. After looking…...