The Qwiet blog

Introduction Content Security Policy (CSP) is pivotal in the vast web security landscape. Much like a dedicated sentinel, it serves as your web application’s first line of defense, ceaselessly monitoring for any anomalies or breaches. Its role is crucial: whenever CSP spots a violation, it raises the alarm, signaling a potential threat. These violations are […]

Introduction OAuth 2.0, the authorization framework, is as ubiquitous as cat videos on the internet. But just like those seemingly innocent videos, OAuth 2.0 can hide some nasty surprises if not implemented correctly. As the digital landscape evolves, so do the challenges and threats developers face. Ensuring that our web applications are secure is not […]

Introduction Error messages in web development can be likened to that friend who always spills the beans at the most inopportune times. They’re well-intentioned, aiming to help developers debug and users understand issues, but they can sometimes be too forthcoming. In the landscape of web applications, such transparency can be a grave security concern. As […]

Introduction Server-side template Injection (SSTI), the digital equivalent of a wolf in sheep’s clothing. It sneaks into your server, disguised as innocent user input, and wreaks havoc. But don’t worry, we’ve got the playbook to outwit this cunning adversary. So, let’s dive into the fascinating world of SSTI, understand its mechanics, and learn how to […]

Tl;dr; Today, we present the results of evaluating Qwiet AI’s static analysis pipeline on the OWASP benchmark, where we achieve a true positive rate of 100% at 25% false positives. With a resulting Youden Index of 75%, this makes our analysis the best in class, beating the commercial average by 45%, and being the only […]

Introduction Directory Traversal Attacks: they’re like the pickpockets of the web, sneaking around your server’s file system, looking for something valuable to snatch. But don’t worry; we’ve got the tools and techniques to catch these digital thieves red-handed. So, let’s get into the nitty-gritty of securing your file handling operations and making your server a […]

You likely know the old saying about “those of us who assume” and what it does to people. Although you typically use this phrase when discussing person-to-person interactions, you can also apply it to application programming. Applications are complex because they often run multiple tasks in a short time. On the other hand, they’re unintelligent […]

It started as a well-intentioned plan to help businesses access real-time tracking data to provide better service to their customers.  The “Informed Visibility System” by the USPS started off with great intentions, but unfortunately rolled out the red carpet for cyberciminals, exposing sensitive data on 60 million users. The business team found a need and […]

Introduction SQL Injection: It’s like the pesky mosquito of web security, always buzzing around, looking for a way to suck the life out of your database. But don’t break out the bug spray just yet; we’ve got two powerful tools to swat this bug: Parameterized Queries and Stored Procedures. So, let’s roll up our sleeves […]