Account takeover

Prevent business-logic flaws with server-side invariants

Recompute prices on the server, run workflows as state machines, build reset links from configuration, limit valuable flows, and turn each business rule into an invariant that the database and the tests both check.

Planning, Design, Testing · Developers, AppSec engineers

Redirect users only to destinations you control

Check every redirect target taken from a request, so attackers cannot borrow your domain for phishing, carry OAuth tokens off-site or steer a server-side fetcher through your redirects.

Design, Development · Developers

Case study: Citrix Bleed (CVE-2023-4966)

How a NetScaler memory over-read leaked session cookies that bypassed passwords and MFA in 2023, why patching did not end hijacked sessions, and how the pattern returned in 2025.

Maintenance · Developers, AppSec engineers

Case study: event-stream and ua-parser-js, two npm package takeovers

Two ways attackers took over popular npm packages: event-stream (2018), handed to a stranger who added a targeted, encrypted payload through a new dependency, and ua-parser-js (2021), whose maintainer's account was hijacked to publish versions that installed malware for four hours. Timelines, detection and the controls that stop both.

Development, Maintenance, Security program · Developers, Platform engineers and SREs

Operate edge rules without hiding application defects

Tune WAF and abuse controls against legitimate traffic, parser behavior and measurable business effects.

Maintenance · AppSec engineers, Platform engineers and SREs

Case study: the CircleCI security incident (January 2023)

How a session stolen from one engineer's laptop reached CircleCI's production systems and customers' stored secrets in 2023, and what platform operators and CI users should change.

Release, Maintenance · Platform engineers and SREs

Account recovery: password resets, help-desk resets and account linking

Treat password resets, support-desk recovery and account linking as new grants of authority: single-use high-entropy proofs, atomic consumption, session revocation, and stable identity rather than email matching.

Development · Developers, AppSec engineers

Stop account takeover with the right MFA and login defenses

Rank MFA options by the attacks they stop, implement TOTP and push approvals correctly, and close the login, reset and recovery paths that attackers use instead of breaking the second factor.

Development · Developers, AppSec engineers

Case study: the Okta support-system breach and session tokens in HAR files (2023)

How a service account password saved to a personal browser profile let an attacker download customers' HAR files from Okta's support system, replay the session tokens inside them against five customers, and stay unseen for two weeks; and why HAR files are credentials, admin sessions need binding, and every exposed credential must be rotated.

Development, Maintenance · Developers, Platform engineers and SREs

Password reset token lab: Make a recovery credential single-use

A recovery link can be redeemed twice when two requests arrive together. Repair redemption so token validation and account changes share one atomic operation.

Business logic lab: Price an order without trusting the client

A checkout trusts the price and quantity each cart line sends, adds every coupon code it recognizes, and never limits redemptions. Customers can choose their price, order negative quantities and stack discounts. Repair the pricing function so every amount comes from server data and every coupon rule holds.

Open redirect lab: Return users to this site only

After sign-in, the login page redirects to whatever its next parameter says, so a link to your own domain can end on a look-alike site. Return users only to a page on this site.