Tested fixes for the weaknesses A09:2025 maps, in Express, Flask and Spring Boot: the vulnerable code, the fix, a wrong fix and the regression tests.
Without logs and alerts, breaches go unnoticed and investigations lack evidence. The 2025 name stresses alerting, because logs that nobody acts on detect nothing.
- Log authentication, access-control and server-side validation failures with enough context to investigate, and keep them long enough.
- Encode log data to prevent injection, and protect logs and audit trails from tampering.
- Send logs to a central system with alerting rules, and practice an incident response plan.
- Fail closed: roll back transactions that error instead of leaving them half done.
Guides on this site
Create security logs someone can investigate
Record meaningful decisions with consistent structure, protect the resulting evidence, and prove that important events reach an operational owner.
Turn runtime events into a tested investigation and containment path
Collect evidence that answers a concrete security question and rehearse the response without destroying the facts needed to investigate.
Secrets management: storage, rotation and leaked-secret response
Follow one application credential from issuance through caching, rotation, revocation and restored backups, prove that its old value stops working, and respond correctly when a secret leaks.
Prevent CRLF header injection, log forging and CSV formula injection
Carriage return and line feed separate HTTP header fields, log records and CSV rows, and a leading = turns a spreadsheet cell into a formula. Let the framework write headers, log structured JSON, and neutralize formula triggers in exports.
Practice
- Insecure randomness lab: Generate unguessable API keys · Browser lab
References
List data from the publisher. A guide is listed as the main subject when the weakness or risk is what the guide is about, and as covering it when a dedicated section or worked example addresses it.