Allen security notes

Self-learning notes on web security, pentesting tools and networking — by allencharp.

Security Design

API Security: The Six Gates 4 September 2026 · api-security · security-design
Pin GitHub Actions to a Commit SHA 29 August 2026 · supply-chain-security · github-actions · cicd · devsecops · security-design
Container Image Signing and Verification 11 August 2026 · supply-chain-security · containers · cosign · sigstore · security-design
Securing Nexus Against Third-Party Supply Chain Poisoning 9 August 2026 · supply-chain-security · nexus · devsecops · repository · security-design

AWS IMDSv1 SSRF 8 August 2026 · web-security · cloud-security · aws · ssrf
OAuth, OIDC and PKCE 23 January 2022 · web-security · oauth · oidc · pkce · jwt · authentication
Log4J Remote Code Execution 10 December 2021 · web-security · log4j · rce
Cookie SameSite Attribute 17 November 2020 · web-security · cookies · samesite
TLS Handshake 20 February 2020 · web-security · tls · crypto
Server Side Request Forgery 18 January 2020 · web-security · ssrf · pentest
ASP.NET Security Feature 22 December 2019 · web-security · aspnet · hardening
CORS Header Misconfiguration 22 September 2019 · web-security · cors · misconfiguration
Json Web Tokens 30 September 2018 · web-security · jwt · authentication