A year with Spectre: a V8 perspective

Experimental Integrity Policies in Node.js

What happens when your AWS secrets are exposed?

How Spectre and Meltdown Work

Security Risks of Changing Package Owners

Trusted Types to prevent Cross-Site Scripting

Blockchain and Trust

The “O​.​MG” USB Cable

Nobody Cares About OAuth or OpenID

Exploiting a Math.expm1 bug in V8

When Packages Go Bad

event-stream Vulnerability Explained

Why do React Elements Have a $$typeof Property?

“I don’t know what to say.”

A Timing Attack with CSS Selectors and JavaScript

Internet Vulnerability Takes Down Google

Why Facebook’s API starts with a for loop

Do You Really Know CORS?

Killing Processes That Don’t Want to Die

Cloudflare now Supports Encrypted SNI

Node.js and the HashWick vulnerability

Crash an Email Server with a Single Email

Security Best Practices in Node.js

Security Keys Neutralized Employee Phishing at Google

Virus in eslint-scope

“I found a major flaw in Mozilla’s private browsing mode.”

“I discovered a browser bug”

Side-channel Attacking Browsers via CSS3

“I’m Not (Overly) Concerned About Smart Speaker Security”

A $36k Google App Engine RCE

Shopify SSRF root access

Fix insecure dependencies with npm audit

A few thoughts on Ray Ozzie’s “Clear” Proposal

BGP leaks and cryptocurrencies

Breaking the Ledger Security Model

Third party CSS is not safe

SRI, CSP and Trust in Third Party Libraries

Understanding the Limitations of HTTPS

Escaping Sensitive Data From Air-Gapped, Faraday-Caged Computers

What Spectre and Meltdown Mean For WebKit

“I’m harvesting credit card numbers and passwords from your site”

Mitigating a New Class of CPU Timing Attack

Most Critical Web Application Security Risks

Securing your Express apps

Messing with the Google Buganizer System for $15,600 in Bounties

Browser Security Beyond Sandboxing

How I Socially Engineer Myself Into High Security Facilities

Exploding Git Repositories

Security Advisory: Mobile Phones

Securing the Tangled Web

“Your Node.js authentication tutorial is wrong”

Recognizing Speech From Gyroscope Signal

XSS via a spoofed React element

XSS on Shopify abusing structured clone in postMessage listener

Using the Strict-Transport-Security header

Reckon you’ve seen some stupid security things? Here, hold my beer…

A new security header: Referrer-Policy

Preventing cross-site attacks using same-site cookies

The Frequency of Known Vulnerabilities in JavaScript

js-vuln-db

Cross-Site Request Forgery is dead!

Content-Security-Policy in Express apps

GitHub’s post-CSP journey