https://securoxen.io/learn Practical security for developers - how it works, then prove it on a real artifact. en Sun, 09 Aug 2026 00:00:00 GMT https://securoxen.io/learn/how-to-send-someone-a-password https://securoxen.io/learn/how-to-send-someone-a-password Chat is not insecure in transit - it is permanent and searchable, which is the actual problem. What to do instead, and why most workarounds do not help. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-a-jwt-actually-proves https://securoxen.io/learn/what-a-jwt-actually-proves A JSON Web Token looks encrypted and is not - anyone holding one can read every claim. What the signature covers, why alg:none works, and why expiry is not revocation. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-a-2fa-qr-code-contains https://securoxen.io/learn/what-a-2fa-qr-code-contains The square holds your TOTP secret in plain text, so a screenshot of it is a credential. What that means for backups, and why TOTP still does not stop phishing. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/reading-a-log-line-under-pressure https://securoxen.io/learn/reading-a-log-line-under-pressure Timestamps in the wrong unit, subnets nobody can size, cron expressions read from memory at 3am. The formats an incident arrives in, and how to convert them without adding mistakes. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/encrypting-a-file-you-have-to-send https://securoxen.io/learn/encrypting-a-file-you-have-to-send Encrypting the file is the easy part. Getting the key to the other side without putting it in the same thread is the part that decides whether any of it worked. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/contrast-is-a-security-feature https://securoxen.io/learn/contrast-is-a-security-feature A warning nobody can read is not a warning. WCAG ratios, why colour alone fails one in twelve men, and why dark mode is a second design rather than an inversion. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-spf-dkim-and-dmarc-each-do https://securoxen.io/learn/what-spf-dkim-and-dmarc-each-do SPF checks the server, DKIM checks the message, DMARC checks they agree with the address you can see. Plus the 10-lookup limit and why p=none protects nobody. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-cors-actually-protects https://securoxen.io/learn/what-cors-actually-protects Not your API. CORS constrains what browser JavaScript may read, and curl ignores it entirely. Plus the reflected-origin-with-credentials combination that undoes it. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/a-pdf-is-an-envelope-not-a-page https://securoxen.io/learn/a-pdf-is-an-envelope-not-a-page Around the pixels you see, a PDF carries a text layer, fonts, metadata and embedded objects - and "saved over" content can stay in the file. Why covering text is not redacting, and what splitting and merging drags along. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/every-image-format-is-a-compromise https://securoxen.io/learn/every-image-format-is-a-compromise Lossy is a verb, not a label: each save degrades again, and conversion is also a privacy decision. A format picker that turns your needs into the format that actually fits them. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/mock-data-is-a-liability https://securoxen.io/learn/mock-data-is-a-liability Realistic fake records become real data by copy-paste, and a Luhn-valid test card is a lesson about shallow validation. Spot the PII fields before the schema becomes your product. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/your-favicon-is-an-identity-vector https://securoxen.io/learn/your-favicon-is-an-identity-vector The tab icon is the most trusted visual on the web that nobody checks - and anyone can clone it. Why 16 pixels is the real canvas, and why the icon is a cue, not a check. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-your-keyboard-actually-sends https://securoxen.io/learn/what-your-keyboard-actually-sends event.key is the character, event.code is the physical key, and keyCode is a deprecated accident. How the three disagree, why shortcuts must use code, and what a global listener really sees. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/why-randomness-is-hard https://securoxen.io/learn/why-randomness-is-hard Math.random is a deterministic algorithm, modulo introduces bias, and an entropy score cannot tell that you chose the string yourself. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-an-ssh-key-actually-authorises https://securoxen.io/learn/what-an-ssh-key-actually-authorises The comment on the end proves nothing, authorized_keys is an access control list nobody reviews, and the options field almost no one uses is the useful part. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/key-management-without-a-vault https://securoxen.io/learn/key-management-without-a-vault For a team of three: enumerate first, rotate on a schedule you can keep, and scope the credential rather than hiding it better. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/the-audit-log-you-will-wish-you-had https://securoxen.io/learn/the-audit-log-you-will-wish-you-had Application logs record what the software did; an audit log records what a person did. Plus the impersonation gap most support tools leave wide open. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/least-privilege-is-a-verb https://securoxen.io/learn/least-privilege-is-a-verb Permissions only ever ratchet upwards, because every grant has a reason and nothing has an expiry. What actually removes access when the reason ends. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/idempotency-is-a-security-property https://securoxen.io/learn/idempotency-is-a-security-property If replaying a request produces a second effect, anyone who can capture it can cause that effect at will. Webhooks, one-time links and TOTP codes all live here. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/how-to-receive-a-vulnerability-report https://securoxen.io/learn/how-to-receive-a-vulnerability-report The most common reason a bug goes unreported is that nobody could work out where to send it. security.txt, a policy that promises not to sue, and fast acknowledgement. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/the-guest-wifi-problem https://securoxen.io/learn/the-guest-wifi-problem A wifi QR code carries the password in plain text on a poster anyone can photograph. Why isolation matters more than the passphrase. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-a-lockfile-actually-locks https://securoxen.io/learn/what-a-lockfile-actually-locks Exact versions and integrity hashes - which makes it a security control, not a convenience. The line worth stopping on is a hash that moved while the version did not. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/the-shared-account-nobody-owns https://securoxen.io/learn/the-shared-account-nobody-owns It destroys attribution, makes offboarding impossible, and usually comes with a TOTP secret screenshotted into a group chat. Including the one you forgot: the registrar. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/security-questions-are-passwords-you-cannot-change https://securoxen.io/learn/security-questions-are-passwords-you-cannot-change Public answers, a tiny answer space, and permanent once leaked - sitting on the recovery path, which makes them an alternative to your password and your second factor. Thu, 06 Aug 2026 00:00:00 GMT https://securoxen.io/learn/passkeys-and-what-they-replace https://securoxen.io/learn/passkeys-and-what-they-replace Not "passwords stored better" - with a passkey there is no shared secret anywhere. Why a breached site leaks nothing usable, and why they resist phishing when TOTP does not. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/why-a-cdn-script-is-a-supply-chain-risk https://securoxen.io/learn/why-a-cdn-script-is-a-supply-chain-risk A script tag says: execute whatever this domain serves, forever. The polyfill.io incident showed how that fails without anyone being hacked - and what actually prevents it. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/how-a-malicious-link-hides-in-plain-sight https://securoxen.io/learn/how-a-malicious-link-hides-in-plain-sight Subdomain tricks, homograph characters and open redirects all defeat "just check the link". Where a browser actually decides which site it is talking to, and how to read it. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-the-padlock-does-not-tell-you https://securoxen.io/learn/what-the-padlock-does-not-tell-you It certifies the pipe, not the people. Certificates are free and instant, so phishing sites have them too - what a certificate does prove, and what to check instead. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/hashing-is-not-encryption https://securoxen.io/learn/hashing-is-not-encryption Three words used interchangeably that do completely different jobs. Why "we store passwords encrypted" is a red flag, and why SHA-256 is a fine hash and a terrible password hash. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-a-csp-actually-stops https://securoxen.io/learn/what-a-csp-actually-stops Most policies in the wild are decorative, undone by a single value. What 'unsafe-inline' gives away, why connect-src is the directive people forget, and how to roll one out without breaking the site. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-file-permissions-actually-mean https://securoxen.io/learn/what-file-permissions-actually-mean chmod 777 makes the error go away and creates the finding in the next audit. What the three digits say, why execute means something different on a directory, and why the fix is usually chown. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/qr-codes-are-links-you-cannot-read https://securoxen.io/learn/qr-codes-are-links-you-cannot-read Every phishing check starts with looking at the URL, and a QR code is a link with the text removed. What a code can carry beyond a web page, and the sticker attack that needs no skill at all. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/the-first-hour-of-an-incident https://securoxen.io/learn/the-first-hour-of-an-incident The instinct that makes it worse is tidying up before containing. Why revoking beats deleting, why changing a password does not end a session, and what not to paste into the incident channel. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-a-regex-cannot-enforce https://securoxen.io/learn/what-a-regex-cannot-enforce A pattern matcher promoted to a security control. Unanchored patterns that mean "contains", one unescaped dot that opens an allowlist, and the nested quantifier that hangs a process. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/why-your-json-is-a-security-boundary https://securoxen.io/learn/why-your-json-is-a-security-boundary Parsing is the easy half. Spreading untrusted data into a config lets the sender choose your settings, inferred types lie about nullability, and a lone null infers as null. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-a-diff-does-not-show-you https://securoxen.io/learn/what-a-diff-does-not-show-you Code review assumes the reviewer sees what changed. Whitespace mode hides indentation edits, big diffs get approved unread, and lockfiles change thousands of lines invisibly. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/timezones-will-ruin-your-logs https://securoxen.io/learn/timezones-will-ruin-your-logs Log in UTC or lose an hour twice a year. The repeated hour is genuinely ambiguous, a window can land on a different weekday, and clock drift rejects valid 2FA codes. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/every-yaml-is-a-program-you-trust https://securoxen.io/learn/every-yaml-is-a-program-you-trust The Norway problem, version numbers that become floats, anchors that expand exponentially, and loaders that instantiate arbitrary types from a document you did not write. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-a-stack-trace-gives-away https://securoxen.io/learn/what-a-stack-trace-gives-away Absolute paths, dependency versions, local variables and customer data - written by your software at the moment it was confused, and pasted into public issues daily. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/the-checksum-you-did-not-verify https://securoxen.io/learn/the-checksum-you-did-not-verify A hash hosted next to its file is a corruption check, not a security control. Why MD5 proves nothing, and what makes a checksum actually mean something. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/base64url-is-not-base64 https://securoxen.io/learn/base64url-is-not-base64 Three characters of difference and a long tail of intermittent bugs. Why a token works for weeks then breaks for one user, and why double-encoding is the wrong fix. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/open-redirects-are-not-harmless https://securoxen.io/learn/open-redirects-are-not-harmless The classic wontfix. It launders your domain so every check a careful user makes passes, and in OAuth it hands the authorization code to whoever set the parameter. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-a-certificate-actually-says https://securoxen.io/learn/what-a-certificate-actually-says A signed statement binding a key to a name - and nothing else. Why EV was abandoned, why self-signed is not insecure, and why the chain is the part that breaks. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/secrets-in-environment-variables https://securoxen.io/learn/secrets-in-environment-variables Moving a secret out of the repo is a real improvement and not a solution. Child processes inherit them, crash reporters capture them, and rotation means a redeploy. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/the-dependency-you-did-not-choose https://securoxen.io/learn/the-dependency-you-did-not-choose You picked a dozen libraries and installed a thousand. Install scripts run before your code does, and a lockfile is a security control rather than a convenience. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/rate-limiting-is-a-security-control https://securoxen.io/learn/rate-limiting-is-a-security-control Most attacks are not clever - they are allowed to run a million times. Credential stuffing, enumeration and 2FA brute force all end at the attempt limit. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/logging-what-you-should-not https://securoxen.io/learn/logging-what-you-should-not Logs are the least access-controlled copy of your most sensitive data. Bearer tokens, reset links and full request bodies, retained forever because nobody owns the decision. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/the-backup-you-never-restored https://securoxen.io/learn/the-backup-you-never-restored A backup that has never been restored is a file with a hopeful name. Ransomware looks for backups first, and RPO and RTO are decisions rather than defaults. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/why-deleting-is-harder-than-it-looks https://securoxen.io/learn/why-deleting-is-harder-than-it-looks Soft deletes, backups, caches, search indexes, logs, third parties and CDNs each learned about the data independently and none are listening for the delete. Wed, 05 Aug 2026 00:00:00 GMT https://securoxen.io/learn/what-a-vpn-does-and-does-not-do https://securoxen.io/learn/what-a-vpn-does-and-does-not-do You are moving trust rather than removing it. The public wifi argument is mostly obsolete now everything is HTTPS, and changing your IP does nothing about fingerprinting. Wed, 05 Aug 2026 00:00:00 GMT