Securing Deliveroo

on YouTube ↗36m

" summary

Deliveroo describes practical security work: create an internal security team, enforce single sign-on with two‑factor everywhere, and tighten physical access (locked doors, guest Wi‑Fi, printer disposal). Run a bug bounty via HackerOne with ~10 hour response targets and payouts up to ~$15k; first triage reduces noise but reveals real angular injections, cookie domain misses, and DNS takeover risks. Deploy Cloudflare for DDoS (migration takes weeks), store passwords with bcrypt, handle GDPR with an Inquisitor event-driven deletion/portability pipeline and defined data lifecycles.

AI-written summary · about

" chapters (14)

1. 0:00Introduction
2. 1:28Why now
3. 3:32Lack of security
4. 6:29Data protection regulation
5. 11:18Lockdown
6. 14:04HackerOne
7. 17:05Insco
8. 18:15Angular Injection
9. 19:33Theists Attack
10. 20:25Application Tier Traffic
11. 21:03Defensive Design
12. 22:16CloudFlare
13. 24:30Personal Data
14. 27:24Data Life Cycles

" related talks

• 28mDefending the HornburgStephen Rees-Carter · Laracon AU 2025
• 21mSecuring a Security CompanyPatrick Cable · LISA18
• 17mYour security is arriving Uber and dataJohn Flynn, Alyssa Newcomb · Collision 2018
• 08mPractical web securityJunade Ali · The Lead Developer London 2015
• 52mContinuous SecurityLaura Bell · NDC Sydney 2017
• 34mStarting a Security Program: Thrills and SpillsPoornaprajna Udupi · BSidesSF 2018
• 16mDeath Star Security: A Realtime Look At How A Site Is HackedChris Teitzel · DrupalCon Amsterdam 2019
• 30mSecurity by StealthGwen Diagram · Agile on the Beach 2019