Most Node.js apps have an auth middleware. You write a protect function, drop it on your routes and call it done. That works fine until you…

Use this repository as a reference guide throughout your software development life cycle, whether you are releasing a new build, applying a…

The setup

Why authentication isn’t enough and where authorization actually belongs.

How browser geolocation, WebSockets, and an interactive map come together in one educational project

Three separate CVSS 10.0 sandbox escapes landed days apart — in a library that was declared dead once already

Building a REST API is only one part of exposing a service to consumers. Once an API is used by multiple applications or users, additional…

Building a Red vs Blue Cyber Range for Cookies Reuse and MFA Bypass A practical write-up on designing the attack story, building the lab, validating the result, and making the evidence visible. I …

Here’s a sentence that should sound impossible: sharing a link to a website could let someone run code on that website’s server. Not…

TL;DR: A path traversal vulnerability in the npm package image-downloader (< 4.3.1, ~38,000 downloads/month) lets an attacker write files…

Finding and Fixing Broken Access Control: A Case Study on Unauthenticated Admin Pages

An unexpected security incident in a Node.js project taught me why we should never blindly trust scripts loaded from external sources.

Not every file our upload endpoint accepts deserves the same treatment.

Build live chat, notifications, dashboards, tracking systems, collaborative features, and other real-time experiences using React, Node.js…

TL;DR On October 21, 2026, the Node.js project shipped versions 22.23.4, 24.22.1 and 26.12.1 to fix 10 vulnerabilities. This Node.js security release patches four high-severity flaws, including a …