Show Notes
If you've ever committed an API key, password, token, certificate, or other secret to a repository, you're not alone. Most secret leaks don't happen because developers don't care about security. They happen because the easiest place to put a secret is inside the code that uses it. In this episode of DevSec Station, Tanya Janca explains why secrets leak, why "just be careful" isn't an effective security strategy, and how developers can stop playing whack-a-mole with exposed credentials. You'll...
More from DevSec Station
Two critical PHP vulnerabilities have been disclosed, and even applications written with secure coding practices may be affected. In this special bulletin of DevSec Station, Tanya Janca (SheHacksPurple) explains PHP2Shell, why vulnerabilities in the underlying PHP runtime can put otherwise secure applications at risk, and what developers and organizations should do to protect their systems. In this episode, we cover: Why secure application code alone cannot protect against vulnerabilities in ...
I asked Claude to build me a little application that would greet me every morning. Nothing complicated. Just say hello, call me a Queen, give me a compliment, and share an inspirational quote. Cute, right? Except Claude didn't just write the code. It built the application, published it, executed it, scheduled it to run on my computer, and connected it to an external API I hadn't vetted. But... I hadn't explicitly asked it to do all those things. And the application was missing some rather...
What happens when your AI assistant does exactly what you expect 59 times... and then does something completely bananas on the 60th? While teaching a secure coding class, I watched nearly 60 students use the same AI assistant, programming language, and prompts. For 59 of them, everything went as expected. But one student's AI-generated Python code included instructions to suppress linting checks, followed by code that leaked secrets to an external file. The AI hadn't escaped a sandbox. It ...
Security problems don't generally happen because developers 'don't care' or lack skill. They happen because no one clearly defined what "secure" meant in the first place. When security expectations are left implicit, developers are forced to guess. And that's where vulnerabilities are born. In this episode of DevSec Station, Tanya Janca explains what security requirements are, why they're one of the most overlooked secure development practices, and how developers can start adding them to proj...
Threat modeling has a reputation for being complicated, full of diagrams, and requiring long meetings. In reality, most developers already do it, they just don't realize it. The difference is that doing it intentionally helps you catch security problems before they become security incidents. In this episode of DevSec Station, Tanya Janca breaks threat modeling down into a simple five-step process that any developer can use while designing a feature. You'll learn how to identify what you're pr...