16 stories tagged web-security, newest first.
15 points by terrybyte | 9 comments
A RackCrunch study scanning 7,040 directory-listed U.S. local-business websites to measure which HTTP security headers they send and misconfigure.
248 points by snikolaev | 247 comments
Transluce research report presenting evidence that AI agents used the web security service urlquery.net to bypass restrictions and attempt hacking activity.
357 points by toilet | 251 comments
A 2019 blog post by Chris Foster arguing that many web developers misunderstand CORS, using the Zoom localhost web server vulnerability as an example.
455 points by dzonga | 265 comments
A GitHub Gist arguing that JWTs should not be used for keeping users logged in and that regular cookie sessions are a better, more secure choice.
590 points by galnagli | 138 comments
Ian Carroll's blog post describing bugs in FIA systems that allowed access to Formula 1 drivers' personal data, including Max Verstappen's passport.
363 points by hallak | 99 comments
A blog postmortem by the creator of DrawAFish.com describing a security incident on the site on August 3, 2025.
493 points by ramimac | 283 comments
Sam Curry's writeup on exploiting Subaru's STARLINK admin panel to remotely track, unlock, and control Subaru vehicles.
487 points by jakey_bakey | 219 comments
Guardian article about a UK company forced by Companies House to change its name, which contained an HTML script tag that could enable cross-site scripting attacks.
681 points by sebnun | 172 comments
The Copenhagen Book is a free, open-source, community-maintained guide to implementing authentication in web applications, by Pilcrow.
543 points by speckx | 320 comments
Sam Curry's writeup on Kia web vulnerabilities that allowed remotely controlling vehicle functions using only a license plate number.
418 points by captn3m0 | 256 comments
A Substack post investigating a cafe's QR code ordering website that collected names and WhatsApp numbers, exploring what data and security issues it exposed.
443 points by n2d4 | 90 comments
Stack Auth blog post explaining OAuth 2.0 by starting from a flawed authorization implementation and iteratively attacking and fixing it.
485 points by udev4096 | 189 comments
A security researcher's blog post describing how they found a flaw in a16z's portfolio.a16z.com site using subdomain scanning and browser inspect element.
536 points by pantalaimon | 367 comments
Blog essay by Henryk Plötz arguing that JSON Web Tokens should not be used as authentication/session tokens, explaining the reasons.
379 points by el_duderino | 120 comments
A blog post describing how the author found and exploited a cross-site scripting (XSS) vulnerability on chess.com.
481 points by celesian | 142 comments
Hakai Offensive Security blog post on hunting Nginx alias traversal misconfigurations in the wild, including one that leaked Bitwarden vault data.