https://blog.secursive.com/ Recent content on Secursive Blog en-us https://blog.secursive.com/posts/cookies-localstorage-sessionstorage-sensitive-authentication-tokens/ 28 Apr 2025 https://blog.secursive.com/posts/cookies-localstorage-sessionstorage-sensitive-authentication-tokens/ Usage of Cookies/LocalStorage/SessionStorage for Sensitive Authentication Tokens Such as Session IDs/JWT https://blog.secursive.com/posts/best-practices-downloading-updates-packages-plugins/ 10 Mar 2023 https://blog.secursive.com/posts/best-practices-downloading-updates-packages-plugins/ Best Practices For Installation Packages, Updates, Plugins Download https://blog.secursive.com/posts/security-recommendations-encrypted-backups/ 17 Feb 2023 https://blog.secursive.com/posts/security-recommendations-encrypted-backups/ Security Recommendations for Encrypted Backups https://blog.secursive.com/posts/avoiding-directory-traversal-java/ 28 Jan 2022 https://blog.secursive.com/posts/avoiding-directory-traversal-java/ Avoiding Directory Traversal in Java https://blog.secursive.com/posts/contact-tracing-surveillance-tracy-app/ 30 Apr 2020 https://blog.secursive.com/posts/contact-tracing-surveillance-tracy-app/ Review of Contract Tracing Tracy App's Security and Privacy https://blog.secursive.com/posts/safely-building-invoking-commands-powershell-scripts/ 15 Apr 2020 https://blog.secursive.com/posts/safely-building-invoking-commands-powershell-scripts/ Using Invoke-Expression is unsafe. This post shows how to build commands from unsafe inputs and execute it in a safe manner. https://blog.secursive.com/posts/critical-look-stakeholder-specific-vulnerability-categorization-ssvc/ 06 Mar 2020 https://blog.secursive.com/posts/critical-look-stakeholder-specific-vulnerability-categorization-ssvc/ This is an initial review of Stakeholder Specific Vulnerability Categorization (SSVC), which is an alternative proposal intended to replace current commonly used metric of Common Vulnerability Scoring System (CVSS). https://blog.secursive.com/posts/safe-renderer-template-functions/ 19 Jun 2019 https://blog.secursive.com/posts/safe-renderer-template-functions/ Creating safe renderer/template functions to avoid XSS https://blog.secursive.com/posts/verifying-ssh-host-key-fingerprint/ 19 Jun 2019 https://blog.secursive.com/posts/verifying-ssh-host-key-fingerprint/ Fetching, verifying, and using SSH Host Key Fingerprint https://blog.secursive.com/posts/subjectname-subjectalternativenames-python/ 19 Jun 2019 https://blog.secursive.com/posts/subjectname-subjectalternativenames-python/ Getting SubjectName and SubjectAlternativeNames in Python https://blog.secursive.com/posts/java-deserialization-xstream/ 19 Jun 2019 https://blog.secursive.com/posts/java-deserialization-xstream/ Java Deserialization Prevention When Using XStream https://blog.secursive.com/posts/recommended-ciphers-macs-ssh/ 19 Jun 2019 https://blog.secursive.com/posts/recommended-ciphers-macs-ssh/ The following Ciphers and MACs are recommended for SSH server and client (ssh_config, sshd_config files). https://blog.secursive.com/posts/recommended-security-http-headers/ 19 Jun 2019 https://blog.secursive.com/posts/recommended-security-http-headers/ Recommended Values for Security relevant HTTP Headers https://blog.secursive.com/posts/secure-communication-frames-browser/ 19 Jun 2019 https://blog.secursive.com/posts/secure-communication-frames-browser/ Secure Communication between Windows/Frames/iframes in a Browser https://blog.secursive.com/posts/securely-connecting-tls-self-signed-ssl-certificate/ 19 Jun 2019 https://blog.secursive.com/posts/securely-connecting-tls-self-signed-ssl-certificate/ If you are using requests directly to make the connection, the following code shows how to verify thumbprint for self signed certificates. https://blog.secursive.com/posts/passwords-commandline-bash/ 19 Jun 2019 https://blog.secursive.com/posts/passwords-commandline-bash/ Securely Reading and Passing Passwords on Commandline in Bash Scripts https://blog.secursive.com/posts/security-file-manipulation-bash-scripts/ 19 Jun 2019 https://blog.secursive.com/posts/security-file-manipulation-bash-scripts/ Please read the following information carefully to avoid making mistakes when creating/moving/deleting files in bash scripts. https://blog.secursive.com/posts/security-considerations-rest-api-developers/ 19 Jun 2019 https://blog.secursive.com/posts/security-considerations-rest-api-developers/ Below are a few important security considerations relevant for REST API developers. https://blog.secursive.com/posts/security-considerations-including-oss/ 19 Jun 2019 https://blog.secursive.com/posts/security-considerations-including-oss/ Security Considerations When Including Open Source Software https://blog.secursive.com/posts/security-considerations-jmx-ports/ 19 Jun 2019 https://blog.secursive.com/posts/security-considerations-jmx-ports/ Security Considerations When Using JMX ports https://blog.secursive.com/posts/angularjs-cross-site-scripting/ 19 Jun 2019 https://blog.secursive.com/posts/angularjs-cross-site-scripting/ Use of Angular JS and Cross Site Scripting https://blog.secursive.com/posts/getting-started-golang-code-review/ 20 Mar 2019 https://blog.secursive.com/posts/getting-started-golang-code-review/ This is a compilation of security knowledge related to Go Language. It is written from the perspective of someone who is going to review code written in Go language to find security vulnerabilities. https://blog.secursive.com/posts/setting-up-workspace-hacking-lab/ 22 Feb 2013 https://blog.secursive.com/posts/setting-up-workspace-hacking-lab/ The human actions seem to be responsible for breaking down the assumptions made by security practitioners (both attackers and defenders). https://blog.secursive.com/posts/cyber-warfare-human-aspects/ 01 Jun 2012 https://blog.secursive.com/posts/cyber-warfare-human-aspects/ The human actions seem to be responsible for breaking down the assumptions made by security practitioners (both attackers and defenders).