SexurityCode blog https://sexuritycode.ru/blog/ Practical write-ups on application security. en Thu, 27 Aug 2026 09:00:00 +0000 Your webhook signature check is probably comparing strings wrong https://sexuritycode.ru/blog/constant-time-comparison/ https://sexuritycode.ru/blog/constant-time-comparison/ Thu, 27 Aug 2026 09:00:00 +0000 Cryptography Why == leaks timing information when you verify HMAC signatures, and how to fix it in Python, Node.js, Go and PHP. Pin the algorithm: JWT confusion bugs that still ship https://sexuritycode.ru/blog/jwt-algorithm-confusion/ https://sexuritycode.ru/blog/jwt-algorithm-confusion/ Wed, 10 Jun 2026 09:00:00 +0000 Authentication How trusting the alg header lets attackers forge tokens, and the few lines of configuration that prevent it. Parameterized queries don't cover ORDER BY https://sexuritycode.ru/blog/sql-order-by/ https://sexuritycode.ru/blog/sql-order-by/ Wed, 18 Mar 2026 09:00:00 +0000 Injection Placeholders bind values, not identifiers. Where SQL injection still hides in codebases that 'always use prepared statements'. A secret got committed. Here's the order of operations https://sexuritycode.ru/blog/leaked-secret-runbook/ https://sexuritycode.ru/blog/leaked-secret-runbook/ Tue, 04 Nov 2025 09:00:00 +0000 Incident response Rotate, check usage, find every copy, then rewrite history. A short runbook for leaked credentials in git.