Defensive Coding Bootcamp
summary
Advocates using vetted auth providers (Okta/Authera) instead of homegrown login code, rotating CI and API keys immediately, and adding end‑to‑end tests that probe the OWASP Top 10; cites the CodeCov breach where a modified Docker image leaked CI env vars to attackers, a Java deserialization RCE via ysoserial, and Parrot drones controllable by scanned MACs. Notes Kubernetes secrets are just base64, warns of MD5/SHA‑1 remnants, and urges input validation, sandboxes, and no secrets in frontend or git.
AI-written summary · about
chapters (19)
- 0:00Defensive Coding Bootcamp
- 4:45Don't (always) build it yourself
- 6:11Plan to rotate your keys
- 8:50Be skeptical about the new library on the block
- 12:07Challenge the status quo
- 14:05Your stack can obfuscate reality
- 20:05Know what tests cover security
- 21:39Secure app!-secure data
- 24:39There is more than one way to approach auth
- 26:27Incorrect encoding & serializations are an issue
- 31:31Code your wrote, with time, will become insecure
- 35:22String comparisons are red flags
- 36:09Don't assume the user will follow your use case
- 37:44Don't assume all cultures have same threat issues
- 40:31Get your head out of the code
- 42:06Have a trusted person take a look
- 42:42CORS is code for TODO
- 43:59Verify that your environment has bare minimum security
- 46:24What do YOU wish you had known about coding defensively?
related talks
43mDefensive Coding Bootcamp
45mDefensive Coding Bootcamp
51mShifting Knowledge Left: Keeping up with Modern Application Security
34mSecure Your Coding Agent Like It’s Malware
36mDevOps Security - Is It Really So Difficult?
28mCode, Dependencies and Security: Where Is the Risk
49mPanel: From Code to Defense: Why Developers Are the New Security Leaders
17mTools & training for more secure software