Notes, shortlists, comparisons

A publication on secure coding for the software we all ship.

Free notes on XSS, auth, and injection. Shortlists and side-by-side comparisons of the security tools teams choose between. Not a vendor pitch.

Browse all articles Compare two tools

SecureCoding ship at a harbor with a lighthouse, crane, and cargo marked with code, lock, and shield.

Compare

Two tools on the dock. See which one to load.

More than 160 side-by-side comparisons of security tools that buyers treat as interchangeable. Type a tool to see its matchups.

All comparisons

CrowdStrikevsSentinelOne WizvsOrca OktavsMicrosoft Entra ID SnykvsSemgrep VantavsDrata ZscalervsNetskope Microsoft SentinelvsSplunk 1PasswordvsBitwarden

Explore our categories

All categories

7 shortlists

Security Operations

See the event, decide if it matters, act before the queue buries it.

5 shortlists

Application Security

The bug is still in the code you ship.

4 shortlists

Identity and Access

Who is in the token, and can you kill the session.

3 shortlists

Cloud Security

The account, not the VM.

3 shortlists

API Security

The contract you shipped, not the happy example.

2 shortlists

Platform security

The factory that ships the workload.

More categories

AI Security Endpoint Security Web Security Cryptography Data Security Email Security GRC and Compliance Network Security Supply Chain Vulnerability and exposure Privacy OT and IoT

Featured

#CSRF

CSRF: SameSite is not enough. Check Sec-Fetch-Site (2026)

SameSite=Lax withholds a foreign POST. A top-level GET and a sibling host still send the cookie. Then Sec-Fetch-Site allow or 403.

#XSS

XSS: encode the sink, then enforce Trusted Types (2026)

textContent encodes characters. innerHTML parses tags. Trusted Types throw on a plain string.

#IDOR

IDOR: put authorization in the query, not the URL (2026)

Authorize the object. WHERE id=? is not ownership.

Latest notes

View all articles

#JWT

JWT in Express: skip it for cookie sessions (2026)

Cookie session first. JWT only when a third party must verify the token.

#Injection

Injection attacks: the ORM is not a guarantee (2026)

Bind parameters. Do not concatenate untrusted input into a query.

#Sessions

Session management: __Host- cookies, Lax, and regenerate

Four belts on one cookie. __Host- refuses Domain.

#TLS

TLS security: 1.3, 200-day certs, and HSTS (2026)

Default is TLSRef Intermediate: 1.2 and 1.3. Not 1.3-only.

#Docker

Docker security: non-root USER, read-only rootfs, pin tags

USER 10001, --read-only plus tmpfs, FROM by digest.

#Stuffing

Credential stuffing: MFA, rate limit, and HIBP (2026)

A stolen list dies at the login door, not after a session exists.

For vendors

Sell a security tool? Put it in front of the people comparing them.

One-time editorial review for a SecureCoding shortlist. Clear decision in 5 business days. A review, not a guaranteed placement.

Get listed