The Qwiet Blog

Key Takeaways False negatives pose a significant hidden risk by allowing real vulnerabilities to slip through security scans undetected, leaving systems exposed without raising alerts. Technical limitations, changing environments, and tool trade-offs are the main reasons false negatives persist, even after decades of AppSec progress. Reducing false negatives requires a comprehensive and layered strategy that […]

After years of uncovering investment and retail banking fraud, I’ve developed a finely tuned radar for risk disguised as innovation. So when security vendors market “community rules” as a revolutionary leap forward, my fraud-detection instincts go haywire. It’s a wolf in sheep’s clothing, a potential threat masquerading as transparency. Let’s be clear: regulated financial institutions […]

Recent breaches at GitLab and GitHub and new research into AI-driven coding expose a troubling pattern in software security: developers have built unified pipelines of tightly integrated tools. While these boost efficiency, they introduce new risks if attackers breach the platform: GitLab disclosed an actively exploited vulnerability tied to how CI/CD job tokens were handled […]

Introduction In software development, transitioning to a microservices architecture is like breaking a big structure into smaller, more connected units. This change lets you scale and be flexible but also brings security challenges. This article looks at how to secure a microservices architecture. It focuses on strategies to isolate and protect each service. Security Risks […]

Introduction In software development, third-party libraries are akin to the gears in a well-oiled machine – essential and powerful, yet requiring careful handling. While they bring efficiency and functionality, they also introduce security risks that can compromise your application. This article aims to guide developers through the labyrinth of third-party library security, offering best practices […]

Whether it’s school or car loans, you know that paying off your debt makes your life easier. It can improve your credit score, giving you more financial security. As a developer, you may also suffer from technical debt that impacts your application’s security. In a world where time to delivery is critical, you may make […]

Introduction Within the cascading bytes and bits of digital communications, developers forge pathways of data, threading information through the vast expanse of the internet. However, threats lurking within these pathways seek to intercept, manipulate, and exploit this data. This article ventures into HTTPS and Strict Transport Security (HSTS), offering developers a guide to comprehend, implement, […]

Introduction Diving into the depths of application development often reveals the lurking dangers of sensitive information exposure. Secure management of environment variables, often used to store secrets like API keys and credentials, becomes a pivotal practice in navigating these treacherous waters. In this deep dive, we will explore the intricacies, best practices, and common pitfalls […]

Introduction GraphQL: A powerful querying language that allows developers to ask for exactly what they need, nothing more, nothing less. While it’s renowned for its efficiency and flexibility, it’s crucial to acknowledge the associated security implications. It’s like the double-edged sword that, if not handled with caution, can lead to potential vulnerabilities. Let’s explore the […]