Logging and detection

Prevent CRLF header injection, log forging and CSV formula injection

Carriage return and line feed separate HTTP header fields, log records and CSV rows, and a leading = turns a spreadsheet cell into a formula. Let the framework write headers, log structured JSON, and neutralize formula triggers in exports.

Development · Developers, AppSec engineers, Platform engineers and SREs

Case study: the tj-actions/changed-files compromise (CVE-2025-30066)

In March 2025 an attacker moved the version tags of a popular GitHub Action, and of a reviewdog action before it, to code that printed CI secrets into build logs. This case study traces the token chain back to one pull_request_target workflow, sizes the exposure, and shows how it was caught and which controls held.

Development, Release, Maintenance · Developers, AppSec engineers, Platform engineers and SREs

Case study: the 3CX DesktopApp supply-chain attack (CVE-2023-29059)

How a trojanized trading application on one employee's personal computer led to 3CX's build servers and to signed, malicious 3CX DesktopApp releases in 2023: the first cascading software supply-chain compromise Mandiant had seen, how EDR caught it, and the controls that would have stopped it.

Release, Maintenance · Platform engineers and SREs

Create security logs someone can investigate

Record meaningful decisions with consistent structure, protect the resulting evidence, and prove that important events reach an operational owner.

Maintenance · Developers, AppSec engineers, Platform engineers and SREs

Turn runtime events into a tested investigation and containment path

Collect evidence that answers a concrete security question and rehearse the response without destroying the facts needed to investigate.

Maintenance · Platform engineers and SREs

Apply a security baseline across AWS, Azure and Google Cloud

Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.

Release, Maintenance · Developers, AppSec engineers, Platform engineers and SREs

Detect container and host threats at runtime with eBPF sensors and cloud services

Watch process, file and network activity inside containers with an eBPF sensor or a managed cloud agent, write and test rules for the attacks you expect, tune them with narrow exceptions and contain a compromised pod without destroying evidence.

Maintenance · Platform engineers and SREs

Case study: certificate expiry outages at Ericsson (2018) and Microsoft Teams (2020), and Equifax's blind spot

How an expired certificate inside Ericsson's core-network software cut mobile data for millions in about 11 countries, how an expired authentication certificate took Microsoft Teams offline, how an expired inspection certificate left Equifax blind for 19 months, through its 2017 breach, and the inventory, automation and testing that prevent each.

Maintenance · Developers, AppSec engineers, Platform engineers and SREs

Case study: Storm-0558 and the forged Microsoft tokens (2023)

How a stolen 2016 consumer signing key and a token validation gap let Storm-0558 read enterprise Exchange Online mail in 2023, and what the review board found about rotation, logging and culture.

Development, Maintenance, Security program · Developers, Platform engineers and SREs

CRLF injection in logs and response headers

CRLF injection happens when request data is written into a line-oriented format, such as a log file or an HTTP header, without encoding, so a carriage return or line feed in it ends the current record and starts one the attacker wrote.