标签：#SEC

The rise of instant payment networks has changed the way money moves. Transactions that once took hours—or even days—now settle in seconds. Whether it's FedNow, RTP, UPI, or other real-time payment systems, users expect payments to be fast, available 24/7, and completed almost instantly. For developers and fintech teams, however, speed creates a new challenge. When payments settle in real time, there's little opportunity to detect fraud, reverse errors, or manually review suspicious transactions. That makes instant payments risk management one of the most important aspects of building modern payment applications. Real-time payment systems leave only seconds to make fraud, compliance, and operational decisions before settlement becomes final. Why Instant Payments Change Everything Traditional payment systems often include a processing window where transactions can be reviewed before settlement. Instant payments remove that safety net. Once a payment is authorized and processed, the funds are typically transferred immediately. If a fraudulent transaction slips through, recovering the money becomes significantly more difficult. That's why payment platforms must shift from reactive fraud detection to proactive risk prevention. What Is Instant Payments Risk Management? Instant payments risk management is the combination of technologies, policies, and automated decision-making that helps businesses detect and reduce risks before an instant payment is completed. Instead of reviewing transactions after settlement, modern payment systems analyze risk while the payment is being processed. Typical risk management includes: Real-time fraud detection Identity verification Device and behavioral analysis Transaction monitoring Sanctions and compliance screening Velocity and limit controls Continuous risk scoring Every one of these checks must happen within milliseconds without creating noticeable delays for legitimate users. Why Traditional Fraud Rules Are No Longer Enough Older p

npm has introduced staged publishing for Node.js, requiring maintainer approval before a version is installable. Versions are queued and must pass a two-factor authentication challenge for release. This feature aims to enhance security amid rising supply chain threats. It is available in npm CLI 11.15.0+ and Node 22.14.0+, alongside new configurable permission flags. By Daniel Curtis

The Hidden Security Gap in Multi-Tenant MCP Servers When you build a multi-tenant SaaS application or an MCP (Model Context Protocol) server that serves multiple organizations, cross-tenant data leakage is one of the most dangerous vulnerabilities you can ship. A single missing organizationId filter in a database query can expose one tenant's data to another — and traditional security scanners like Snyk, Semgrep, and CodeQL don't catch these patterns. That's why I built mcp-tenant-isolation — a static analysis scanner with 57 deterministic rules specifically designed to catch tenant isolation failures in multi-tenant codebases. What Is Tenant Isolation? Tenant isolation ensures that data belonging to one organization (tenant) is never accessible to another. In a multi-tenant SaaS app, every database query, cache read, and file access must be scoped to the current tenant's organizationId . The most common failure looks like this: // VULNERABLE: No organizationId filter const users = await prisma . user . findMany ({ where : { role : ' admin ' } }); // SECURE: Tenant-scoped query const users = await prisma . user . findMany ({ where : { role : ' admin ' , organizationId : ctx . orgId } }); It looks obvious in isolation. But in a codebase with 100+ API routes, dozens of lib functions, and complex middleware chains, missing tenant filters are easy to miss in code review and impossible for traditional SAST tools to detect . Why Traditional Scanners Miss This Tools like Snyk and Semgrep are excellent at detecting: SQL injection XSS Dependency vulnerabilities Secret leakage But they don't understand tenant context . They don't know that organizationId is the tenant boundary. They don't track which functions require tenant guards. They can't tell you that prisma.user.findMany({ where: { role: 'admin' } }) is missing a critical tenant filter. mcp-tenant-isolation fills this gap with 57 rules across 7 categories: Rule Categories Category Rules What It Detects Database Queries

When people discuss AI agents escaping their boundaries, the mental image is usually dramatic: a jailbreak, a rogue prompt, an obvious disaster. What I've actually seen in practice is duller and more dangerous. The agent finishes its task successfully, the tests pass, and only later does someone notice it edited a file three directories up, or that a "helpful cleanup" deleted something it shouldn't have. Silent drift, not explosions. Last month I wrote about building a prompt regression harness that runs entirely on free tiers. This piece extends the same instinct from what the model says to what the agent does : I wanted a cheap, repeatable way to answer one narrow question — when my agent uses its tools, which parts of this machine does it actually reach? The specific risk I'm measuring A typical coding agent gets handed some mix of shell access, filesystem tools, and HTTP. The failure that matters most in day-to-day use isn't an adversarial attack. It's ordinary helpfulness with sloppy scope: An instruction like "find the relevant config" becomes a walk up the directory tree into your dotfiles. A refactoring task spills into a sibling repository because both were visible. A scratch file gets written somewhere outside the intended workspace and quietly persists. A fetch tool designed for one documentation site ends up POSTing context somewhere else. Notice that nothing here requires a malicious model. A cooperative model with generous tool permissions produces the same outcome. So the question isn't "can I trick the agent into misbehaving" — it's "does the sandbox I believe in actually exist." A probe harness you can run tonight The approach: hand the agent tasks engineered to invite scope violations, record every filesystem change it makes, and compare those changes against an explicit allowlist. Anything outside the list fails the run. The script below is pure standard-library Python. Instead of strace or eBPF (which need privileges you often don't have), it sna

A malicious Ollama model is not a virus you double click, but it is untrusted input handed to a C parser, a template engine and your filesystem in one request. The realistic damage from a hostile /api/pull is disk exhaustion, VRAM starvation, blob writes under ~/.ollama/models , a poisoned chat template that silently rewrites every prompt, and memory corruption in the GGUF loader if the file is crafted for it. None of that requires a vulnerability in your app code, only an Ollama daemon that trusts whoever can reach port 11434 and whichever registry a tag points at. Bind the daemon to localhost, pin models by SHA256 digest, run the container as a non root user with a read only root filesystem and a capped model volume, and the entire class collapses to a bad model that answers badly. TL;DR by reader profile: Solo developer running Ollama on a laptop, for example a contractor testing llama3.1:8b locally: leave OLLAMA_HOST at 127.0.0.1:11434 and pin digests, because your only real exposure is pulling a model whose tag moved under you. Two person startup running Ollama on one rented GPU box, for example a founder pair serving an internal assistant: run it in Docker as UID 1000 with --read-only , --cap-drop ALL and a sized model volume, because a single unbounded pull can fill the disk that also holds your Postgres data. Team fronting Ollama with Open WebUI or Continue, for example five engineers sharing one workstation: put model management behind the proxy and block /api/pull , /api/create , /api/push and /api/delete for normal users, because chat access and registry access are not the same privilege. Anyone building agents or RAG on Ollama, for example a support bot with tool calling: treat the Modelfile TEMPLATE and SYSTEM blocks as attacker controlled text, because a poisoned template reaches the model before your prompt does. Consultancies holding client data, for example a two person shop under an NDA: keep model pulls on a staging host, mirror approved blobs int

Rate limiting is one of those things that doesn't feel urgent—until someone hammers your login endpoint at 3am and you wake up to a flooded database and a locked-out user base. I added this to my Nuxt base layer after realising I'd shipped several projects with zero protection on auth routes. Not great. This post walks through the exact setup I now use: Redis-backed, an in-memory fallback when Redis is down, named presets for different sensitivity levels, and a 429 page that shows a live countdown instead of just dying on the user. The structure Three pieces, each with one job: createRateLimiter() — a factory that builds the limiter, using Redis with an in-memory fallback applyRateLimit() — what you call inside handlers to enforce a limit server/middleware/rateLimiter.ts — global middleware so every route gets a baseline for free 1. Install npm install rate-limiter-flexible ioredis rate-limiter-flexible does the heavy lifting: sliding windows, Redis integration, and the insurance fallback pattern we'll use. 2. The factory Create server/utils/rateLimiter.ts : import { RateLimiterRedis , RateLimiterMemory , type RateLimiterAbstract , } from ' rate-limiter-flexible ' import { getRedisClient } from ' ./redis ' export interface RateLimiterConfig { keyPrefix : string // Must be unique per limiter, e.g. 'rl:auth' limit : number // Maximum requests within the window windowSeconds : number } export interface RateLimitResult { allowed : boolean limit : number remaining : number resetAt : number // Unix timestamp in seconds when the window resets retryAfter : number // Seconds until retry; 0 if allowed } function buildLimiter ( config : RateLimiterConfig , ): RateLimiterAbstract { const insurance = new RateLimiterMemory ({ keyPrefix : config . keyPrefix , points : config . limit , duration : config . windowSeconds , }) const redis = getRedisClient () if ( ! redis ) { return insurance } return new RateLimiterRedis ({ storeClient : redis , keyPrefix : config . keyPrefix , points

The first time I ran my vulnerability scanner against the industry-standard benchmark, the bottom line of the scorer's report was this: $ python scripts/score_benchmark.py --findings out/java.findings.json \ --truth benchmark-java/expectedresults-1.2.csv OVERALL precision 0.60 recall 0.07 F1 0.13 # abridged Three numbers, and here is what each one means. Precision 0.60 — of all the alarms the scanner raised, 60% pointed at real bugs: when it spoke, it was right more often than not. Recall 0.07 — of all the real bugs in the benchmark, it found 7%. In the four vulnerability classes my scanner covers, the benchmark contains 777 real, labeled vulnerabilities; it missed 93% of the bugs it exists to find. F1 0.13 — precision and recall combined into one score (their harmonic mean), dragged down to almost nothing by that recall. My first instinct was to fix it before anyone saw it. Instead I saved the output, wrote the number into my benchmark log, and kept it — because that number was always going to be published, and this is the article that publishes it. The Context For the past months I've been deep in AI — reading, building, measuring. One of the projects that came out of it is an AI vulnerability scanner. The design in one sentence: deterministic static-analysis rules do all the searching, and an LLM judges each finding — is this a real bug or a false alarm? The full architecture gets its own article. This one is about the first measured number. The test set is the OWASP Benchmark — 2,740 labeled Java test cases, the standard exam for Java security scanners. In my scanner's four vulnerability classes (SQL injection, command injection, path traversal, XSS) there are 1,478 cases: 777 real vulnerabilities and 701 cases deliberately designed to bait scanners into raising false alarms. Every tool I compare against — Semgrep, CodeQL — takes the same exam, scored by the same scoring code. Same rules for everyone. New to this? Three words carry this article. A source is wher

Security researchers tracked and eavesdropped on a WIRED reporter using vulnerabilities in a pink plastic smartwatch. It’s just one piece of a deeply insecure supply chain of GPS-enabled gadgets.

Here is how I hardened the browser runtime for a Zero-Knowledge, Non-Custodial FinTech trading terminal. 👇 Client-Side Envelope Encryption: I derive a KEK from the user's password using PBKDF2-SHA256 (310,000 iterations). Then, a secure random 32-byte DEK (AES-256-GCM) encrypts the data. The password NEVER touches the server, and the DEK has a strict 15-min TTL in RAM before a wipe. Secure Enclave Anti-Export Guard: CryptoKeys are generated via crypto.subtle with {extractable: false} . To prevent injected malicious scripts from bypassing the sandbox, I implemented an isolated closure that overrides (monkey-patches) the native browser API: crypto.subtle.exportKey = async function(format, key) { if (isProtectedKey(key)) { _AuditChain.append('EXPORT_ATTEMPT', 'CRITICAL'); throw new Error('Export BLOCKED — unauthorized'); } return _origExport(format, key); }; If our database is breached, hackers find ZERO financial data. If the local session is compromised, runtime gating blocks extraction. Plus, client-side validation rejects API keys with withdrawal permissions enabled (zero custodial risk under MiCA, built for GDPR). The entire architecture runs client-side (WebSocket throttled at 100ms + local AI Advisor), keeping server costs near zero. Where does this runtime isolation logic fail? Why do major SaaS platforms still rely on standard local storage? Let's discuss. 💬

Groups of hackers are breaking into large U.S. financial firms to steal sensitive data and extort victims, Google’s security researchers report.

Flock posted videos on its YouTube channel highlighting at least four police departments whose officers have faced allegations of misusing the company’s tech.

Researchers linked the latest malicious activity to a Chinese company, after one of the spyware's operators placed an order with KFC using their real name and office address.

GitHub malware advisories no longer stop at npm. Here's how we wired OpenSSF's malicious-packages data into the Advisory Database, and why we built the pipeline paranoid. The post How we took malware advisories beyond npm appeared first on The GitHub Blog .

Connor Moucka pled guilty to hacking and stealing data from more than 165 Snowflake customers, which net him and his accomplices more than $2.5 million in ransom payments.

security #api #webdev #discuss The chat went live at 2 PM. By 2:14 it was a war zone. I thought adding real-time chat to my dev blog would spark pair-programming threads. Instead, bots flooded it with phishing links and slurs. One bot even dropped an oddly specific threat about my home city. I flipped on request logging. In the next 24 hours it logged 52 distinct attacker hostnames. IP bans did nothing. They came back from new IPs, new ASNs, new registrars. IP bans felt like swatting flies. I wanted to know what these domains actually were. That's when I started bulk-WHOISing every domain they posted. What 52 hostile domains actually look like I wrote a small Python runner. Feed it a list of hostnames and it spits out JSON. The first version used public RDAP servers directly. Public RDAP servers were slow, rate-limited, and ccTLDs broke them. I wanted DNS, SSL, subdomains, email history, and takeover risk in the same response. I landed on the enrichment endpoint at RapidAPI and put the script on GitHub . import json , time , sys , os from urllib.parse import quote import requests RAPIDAPI_KEY = os . environ . get ( " RAPIDAPI_KEY " , "" ) BASE_URL = " https://domain-whois2.p.rapidapi.com/whois " HEADERS = { " X-RapidAPI-Key " : RAPIDAPI_KEY , " X-RapidAPI-Host " : " domain-whois2.p.rapidapi.com " } def lookup ( domain : str ): url = f " { BASE_URL } ?domain= { quote ( domain ) } " try : r = requests . get ( url , headers = HEADERS , timeout = 20 ) r . raise_for_status () return r . json () except requests . exceptions . Timeout : return { " domain " : domain , " error " : " timeout " } except requests . exceptions . HTTPError as e : return { " domain " : domain , " error " : f " http { e . response . status_code } " } except Exception as e : return { " domain " : domain , " error " : str ( e )} def batch ( domains , delay = 0.6 ): results = [] for d in domains : print ( f " [*] { d } " , file = sys . stderr ) results . append ( lookup ( d )) time . sleep ( delay ) r

Let's dive in to Roku's privacy policy to see what data is being collected from you -- and how to stop it.

* *The purpose of this light version threat model is to demonstrate how STRIDE can be applied to an ECG device. It is intended for readers learning system decomposition and threat modelling techniques. The example includes a simplified set of components, threats, and mitigations for educational purposes and is not intended to represent a comprehensive medical device cybersecurity assessment or any regulatory submission. **Assumption: This example models a typical ECG device, which may include network connectivity in a clinical environment. Trust Boundaries: Trust boundaries exist between the ECG device, hospital network, and external clinical systems. System Definition: ECG is the abbreviation for an Electrocardiogram. It is used to detect electrical activity of the heartbeat in the form of P wave, QRS complex and T wave to identify and diagnose irregularities in heartbeat. Electrodes are placed on patient’s limbs and chest to measure the electrical potentials. It translates tiny electrical signals into digital wave patterns. These waveforms are used by the doctors to evaluate the heart rhythm and check for cardiac damage. Components • Electrodes • Lead wires • Amplifier and filters • Analogue-to-Digital Converter (ADC) • Main processing unit • Display/printer • Local storage • Network interface (Ethernet/Wi-Fi/Bluetooth), if supported. Data Flow Diagram: Electrodes → Lead wires → Amplifier and filters → Analogue-to-Digital Converter (ADC) → Main processing unit → Display / Printer / Local storage / Network interface (if supported) |TRUST BOUNDARY|→ Electronic Health Record (EHR) / Clinical Information System 2. STRIDE Threats: Threats Description Spoofing in general ** - Spoofing is the act of impersonating a legitimate user, device, or system to gain unauthorized access to resources or services. Violates authentication. * Spoofing in ECG * - An attacker may impersonate an authorized clinician, connected medical device, or trusted clinical system to gain unauthoriz

I Replaced kube-proxy with eBPF in Production (And Why My Monitoring Went Blind for 6...

There are many companies manufacturing adversarial clothing designed to confuse facial recognition systems. It’s a cool idea, but I worry that it’s mostly security theater: “Our patterns play with that chaos, confuse algorithms and make it way harder to pin you down,” he said. Bell, however, said “none of these products are tried and tested, and a lot of these surveillance technologies can deal with a little resistance … [but] even if the designs don’t necessarily work perfectly, fashion is also a visible sign of resistance. “This is consumers collectively coming together to make a visible statement.”...

Every automated Solidity security tool has the same disease: it cries wolf. Run one on an audited protocol and you get 600 "findings," 98% of which are noise. The tragedy isn't the wasted time — it's that after the tenth false alarm, you stop reading. The one real bug then hides in the noise. I spent this week hand-verifying every flag my scanner produced against production protocols (Ember, Euler, Liquity, Arcadia, Rubicon, and more). Every single one was a false positive. Here are five of the most common classes, why a naive tool reports them, and the deterministic check that kills each — no AI guesswork required. 1. The "spec violation" that's just... the design A tool reads a spec or a NatSpec comment — "only the rate manager can update the rate" — and flags the function as a violation because it "can't prove" the restriction. On Ember's vaults this produced a CRITICAL : function pause() external onlyGuardian { ... } function processWithdrawalRequests(uint256 n) external onlyOperator { ... } function setMaxTVL(uint256 v) external onlyAdmin { ... } Every one is a correctly access-controlled, intended feature. The tool listed the protocol's own role design and called it a bug. The fix: before emitting, find the affected function and check whether the restriction is actually enforced ( onlyX / onlyRole / require(msg.sender == ...) ). If it is, it's the design, not a violation. If there's genuinely no guard, it still fires. Safe direction. 2. Fee-on-transfer on a token that can't be fee-on-transfer A vault does token.transferFrom(user, address(this), amount) and uses amount for accounting. Fee-on-transfer tokens arrive short, so the internal books inflate → the tool screams "insolvency." Real? Only if users can deposit arbitrary tokens. Two very common cases where they can't: // (a) the deposit is onlyOwner — the owner picks what enters function deposit(address token, uint amount) external onlyOwner { ... } // (b) the token set is curated by a registry / whitelist u