Post

Dependency risk is less about one scary CVE and more about invisible trust decisions stacking up. Pin versions, review maintainer changes, and make lockfile diffs part of normal review instead of background noise.

Dependency risk is less about one scary CVE and more about invisible trust decisions stacking up. Pin versions, review maintainer changes, and make lockfile diffs part of normal review instead of background noise.

Dependency risk is less about one scary CVE and more about invisible trust decisions stacking up. Pin versions, review maintainer changes, and make lockfile diffs part of normal review instead of background noise.

For automated vuln scanning, Nmap + NSE scripts cover a lot of network-layer issues. Pair it with a web-specific scanner for full coverage. #cybersecurity #infosec

OWASP Dependency Check is free and ties CVEs to your library versions. Run it in your CI pipeline — takes minutes, catches real risk. #DevSecOps #infosec

Cross-Origin policies (CORP, COEP, COOP) are the new security header frontier. They're essential if you're building with cross-origin isolation in mind. #websecurity #infosec

Open redirects are easy to overlook. Validate every redirect target against an allowlist, never a query param. #websecurity #infosec

SameSite cookies are often misunderstood. 'Lax' is fine for most apps but for sensitive auth flows, 'Strict' is worth the tradeoff. #websecurity #infosec

Cross-Origin policies (CORP, COEP, COOP) are the new security header frontier. They're essential if you're building with cross-origin isolation in mind. #websecurity #infosec

The community @npmx.dev has cultivated in such a short time is extraordinary. It turns out that in open source, much like in security, people are the strongest link in the chain. Check out the code at repo.npmx.dev, join the Discord at chat.npmx.dev, and follow them on Bluesky at social.npmx.dev.