GraphQL Vulnerability
The relational aspect of GraphQL can be a vulnerability exploited by running deep and cyclic queries causing your API to crawl under the load and crash. That's a Denial of Service. Learn how it works and how you can protect your API!
GraphQL Vulnerability
You receive a call in the middle of the night from the SRE team: All production data has been deleted from your company's various relational databases. Many of the company's internal services are therefore down. You absolutely need to fix the problem immediately and identify the problem. Once you log into the company's system you find that much of the information in your databases has been lost. Fortunately, you have a daily data backup so you can quickly restore the database to its previous
GraphQL Vulnerability
Back at the office, you try to connect to one of your application's servers. But for some reason, your account is no longer granted access. Anyway. You have a backup so you can restore it to a previous state in a minute. Still, you have to figure out what happened so it doesn't happen again. From the activity logs, it looks like you changed your user's password on this machine yourself but from an unusual address. Of course, you did not... That means someone had access to your credentials fo
GraphQL Vulnerability
GraphQL offers an amazing developer experience. But the same features that help you in development, can disclose critical information to cyberattacks in production. Learn how you can fix this vulnerability.
GraphQL Vulnerability
HTTP is the text protocol that has been running the web, but its upgraded version HTTPS should always be preferred to avoid data leaks. Read more to understand the risk and how you can implement the security fix in your GraphQL framework of choice.
GraphQL Vulnerability
GraphQL aliasing is a powerful feature. But with great power comes great vulnerability: batch attacks and DoS. In this post, we explain how it works and how to remediate it in your GraphQL API.
GraphQL Vulnerability
CSRF (Cross-Site Request Forgery) is one of the top 3 most common vulnerabilities of web applications. It forces authenticated users to perform unwanted actions. In this post, we explain how it works and how to remediate it in your GraphQL API.
GraphQL Vulnerability
Confusion between authentication and authorization causes data leaks. Learn the difference and how to implement the right access control pattern in your GraphQL API.
AppSec
GraphQL Playground has had a known XSS security issue since 2020. We give 2 very concrete scenarios to show you how it could unfold if it were to be exploited in your organization.
Startup Security
Many SaaS startups fail to understand the importance of the EU’s new set of rules concerning their citizens' personal data, and some paid a hefty price. Read along to understand the what, why and how of GDPR compliance.
Pentesting
Introducing Graphinder, a lightweight and blazing fast GraphQL endpoint finder, making penetration testing on GraphQL much faster ⚡️
Tutorial
The adoption of GraphQL is growing like crazy. But the learning curve is steep and getting started can be overwhelming. Here's our 8-step roadmap to ship production-ready APIs
Best Practices
Error messages in GraphQL are rarely seen as a security concern, yet they should. The risk? Leaking information and data! Learn more about GraphQL errors and how to handle them.
Startup Security
How many entrepreneurs feel a filial connection with their business, such as Demeter’s passion for Persephone? If Hades abducted Persephone on his golden chariot drawn by immortal horses, the infants of start-up founders are threatened by a more nebulous danger: cyberattacks.
Tutorial
There are two approaches to defining your schema in GraphQL: schema-first and code-first. When using Typescript, you might find yourself having to write types again and again. Enters GraphQL codegen: your schema file becomes the single source of truth.
Startup Security
Why should you care about security in a SaaS Startup? 1) To avoid expensive Data Leaks 🥷 A common misconception among startups is that only big corporations, or large scale-ups, are targeted by cyberattacks. Unfortunately, startups of all sizes can be targeted: from the 139 Million records leaked by Canva in 2020 to the 70 000 records leaked by start-up Mercato in 2019 before its Series A. According to a study by IBM, the average cost of a leak is 150$ per record. One can quickly imagine t
AppSec
GraphQL has no security by default. All doors are open for the most basic attacks. Read more to learn about the exact threats and some simple strategies you can implement to get your users' data under lock and key 🔐
Startup Security
In Ukraine, web APIs have demonstrated their value to achieve democratic progress through e-governance. Nonetheless, API security has revealed its vital nature in light of the cyberattacks launched by Russian state-sponsored hackers.
Tutorial
Testing your GraphQL API is critical to ensure that your software's business logic is running as expected. Tests will reveal bugs and vulnerabilities before they make it to production. In this tutorial, we go through the practical steps to write unit and integration tests for your GraphQL API.
DevSecOps
DevSecOps aims at integrating security inside the development process. It can be hard to know where to start. In this article, learn the best practices to implement DevSecOps in your engineering teams.
DevSecOps
This last part of the DevSecOps 101 series shows you how to scan your Docker images using Trivy, an open-source security scanner to find misconfigurations and vulnerabilities.
DevSecOps
This article is part of a series about integrating security tooling in the development process. You can find the rest of the articles here: * Part 1: Detecting Insecure Dependencies (SCA) * Part 2: Detecting Insecure Source Code (SAST) * Part 4: Scanning Docker Images With Trivy Note: This tutorial is based on the repository resulting from part 2. If you haven't achieved it yet, no worries! You can directly fetch the result from Github. If you already have done the two first parts of the tu
Open Source
Ever had troubles managing your git hooks in a monorepository ? We did too, so we created Mookme to solve our problems. Here is a git hook manager for dealing with different projects and languages, automated filtering, ease of configuration and setup.
DevSecOps
In this tutorial, we will learn how to detect and fix vulnerable Python code using Semgrep.
