# Security · Tech watch [Canonical source]() Protecting applications and infrastructure through vulnerability analysis, controls and defensive practices. ## [Cloudflare Security Audit Skill structures agent-led audits]() This skill turns a coding agent into a security auditor by orchestrating a six-phase repository audit, from reconnaissance to report generation. Findings are structured as machine-readable data and independently verified. A separate agent tries to disprove each candidate; results distinguish confirmed findings, leads needing validation, and rejected candidates. Running target code requires an OS-enforced sandbox with external networking disabled and resource limits in place. 2026-11-02 · [Markdown]() · [Original resource]() ## [Fetch Metadata: using request context to strengthen CSRF defenses]() The four Fetch Metadata headers tell servers where a request came from and how its response will be used. Andrew Lock explains `Sec-Fetch-Site`, `Sec-Fetch-Mode`, `Sec-Fetch-Dest`, and `Sec-Fetch-User` to help distinguish, for example, a legitimate navigation from a suspicious cross-site request. Examples contrast an image loaded from a CDN with a JavaScript `fetch()` call. Because JavaScript cannot modify these signals, servers can use them in a Resource Isolation Policy as an additional layer of defense against CSRF requests. 2026-11-02 · [Markdown]() · [Original resource]() ## [.NET multi-tenancy: query isolation and SQL Server partitions — part 1/4]() This first installment presents a shared-schema .NET multi-tenant design: EF Core filters reads by tenant, while SQL Server physically partitions rows to speed up data access. The key distinction is that partitioning is not a security boundary; isolation relies on the EF Core global query filter. The article also explains resolving the tenant per request, assigning its ID to new rows, and adding partitions to migrations with raw SQL. The primary key must include `GuildId`, a constraint SQL Server imposes when partitioning a unique index. 2026-11-02 · [Markdown]() · [Original resource]() ## [WordPress RCE flaw targets the update window]() A remote code execution flaw in WordPress Core can let an unauthenticated attacker run code during a full-package update if the temporary directory is web-accessible. Wordfence says it blocked 62,969 attempts in 24 hours; a fix is available in version 7.1.4. The attack hinges on racing cleanup: installer files are unpacked to a predictable path under `wp-content/upgrade`, and attackers are repeatedly probing files such as `setup-config.php` to catch the exposure window, which may last only seconds. The flaw affects versions 4.7 through 7.1.3. 2026-10-31 · [Markdown]() · [Original resource]() ## [CVEngine connects attack-surface discovery with CVE validation]() CVEngine brings continuous asset discovery, vulnerability scanning, and matching against exploited CVEs into a self-hosted platform. It aims to prioritize flaws that actually apply, using read-only validation and evidence rather than presenting only a list of alerts. Version 1.3 adds Sentinels to run scans from private networks, along with an OpenVAS integration that is disabled by default. Results feed the same inventory and severity ratings; the tool also provides a REST API and MCP integration. 2026-10-31 · [Markdown]() · [Original resource]() ## [WebCheck: inspect the public signals a website exposes]() WebCheck brings publicly exposed domain information into one interface: DNS, TLS certificates, HTTP headers, subdomains, detected technologies, and potential threat-list matches. It offers **44 checks** and can also examine redirects, trackers, and email configuration. The results provide a useful starting point for surface-level checks, not a substitute for a thorough audit: some data, such as vulnerabilities linked by Shodan, depends on external sources. The project is open source, can be self-hosted, and provides an API. 2026-10-29 · [Markdown]() · [Original resource]() ## [The Website Specification: practical technical criteria for websites]() This specification brings together 178 topics covering a website’s technical responsibilities, including HTML, accessibility, security, performance, SEO, privacy and resilience. Each topic explains why it matters and how to implement it, with items marked as required, recommended, optional or to avoid. A yes/no checklist turns those criteria into an audit that teams can revisit after fixes. Grounded in primary sources and platform-agnostic, the specification is also available to agents through a read-only MCP server, with no authentication required for its reference tools. 2026-10-29 · [Markdown]() · [Original resource]() ## [DeadTag turns abandoned website tags into iPhone attack paths]() Expired domains behind old analytics and advertising tags have been bought and repurposed to redirect visitors to malicious content, including the Coruna and DarkSword iOS exploit kits. Report URI and iVerify describe a chain that filters visitors and tailors its payload to the device; security scanners may receive only an empty response. The case shows how a forgotten third-party script remains an active dependency: its domain can change hands without any site change. The article recommends auditing tags, monitoring loaded scripts, and restricting their domains with a Content Security Policy. 2026-10-29 · [Markdown]() · [Original resource]() ## [WebSub: standardizing HTTP push subscriptions]() WebSub defines a notification protocol between publishers and subscribers: a subscriber discovers a hub, registers a callback URL, and receives updates from the hub over HTTP. The specification covers subscription validation, renewal, and delivery retries, while leaving the mechanism publishers use to notify hubs unspecified. The updated W3C Recommendation adds safeguards against XSS attacks during subscription verification. It also specifies HMAC signatures for notifications: SHA-1 remains common for compatibility, the document notes, but recommends at least SHA-256 when TLS transport may be compromised. 2026-10-29 · [Markdown]() · [Original resource]() ## [React Server Components: critical remote code execution flaw]() A critical vulnerability enables unauthenticated remote code execution in some applications using React Server Components. It affects `react-server-dom-webpack`, `react-server-dom-parcel`, and `react-server-dom-turbopack` in the versions listed in the advisory, with a CVSS score of 9.5. The described scenario is rare: it requires responses that transport multiple typed arrays and an attacker-controlled value. React applications without a server are unaffected, as are applications that do not use a framework, bundler, or plugin supporting Server Components. Fixes are available in 19.0.9, 19.1.10, 19.2.9, and 19.3.1; affected deployments should upgrade immediately. 2026-10-23 · [Markdown]() · [Original resource]() ## [croc: fast, secure, cross-platform file transfer]() croc enables sending files or text between two devices with end-to-end encryption, no network setup, and no user account. The tool works via CLI or a web interface, generates a shareable code, and supports multi-file, folder, and resumable transfers. It stands out for its ease of use, cross-platform support, and a user experience often considered more polished than Magic Wormhole. 2026-10-20 · [Markdown]() · [Original resource]() ## [Next.js September 2026 security fixes in 16.3.8 and 15.5.27]() Next.js releases 16.3.8 and 15.5.27 to address several vulnerabilities, including image optimization SSRF and cache poisoning issues. The advisory identifies affected configurations to help teams prioritize the update. 2026-10-13 · [Markdown]() · [Original resource]() ## [A front-end checklist with more than 350 quality rules]() Front-End Checklist organizes more than 350 rules into review workflows for accessibility, CSS, performance, security, privacy, and SEO. It offers guided launch and audit checklists, and exposes the same standards to agents through MCP for more structured code reviews. 2026-09-18 · [Markdown]() · [Original resource]() ## [IP blocklists refreshed every two hours]() This repository maintains lists of IP addresses identified as malicious and refreshes them automatically every two hours. It also publishes statistics and exclusions for major public DNS resolvers, helping reduce the chance of blocking legitimate services when using the lists. 2026-09-15 · [Markdown]() · [Original resource]() ## [Croc: transfer files between machines with a share code]() Croc transfers files between computers using a shared code and an encrypted relay. The project offers binaries and a web interface without requiring a manually configured transfer server. 2026-08-12 · [Markdown]() · [Original resource]() ## [Check browser support for the \`Clear-Site-Data\` header]() This Can I Use entry summarizes browser support for `Clear-Site-Data`, a header that asks browsers to clear selected site data. Check compatibility before using it in sign-out or security flows. 2026-05-10 · [Markdown]() · [Original resource]() ## [Monty: sandbox AI-generated Python code]() Monty is a Rust-written Python sandbox for running code produced by models. The repository focuses on controlled execution and a runtime designed for agents. 2026-02-11 · [Markdown]() · [Original resource]() ## [Infisical: centralize secrets, certificates and privileged access]() Infisical organizes application secrets and configuration across environments. Versioning and rotation are among the mechanisms provided for managing their lifecycle. 2025-12-14 · [Markdown]() · [Original resource]() ## [Bastillion: centralize SSH terminals and key management]() Bastillion opens SSH sessions from the browser and manages key distribution across registered hosts. It provides a shared interface for access and key rotation. 2025-12-08 · [Markdown]() · [Original resource]() ## [SafeLine: a self-hosted web application firewall]() SafeLine filters and monitors HTTP traffic in front of web applications. The repository explains its reverse-proxy role and the attack classes its protections target. 2025-09-28 · [Markdown]() · [Original resource]() Page 1 / 2 [Next]()