Practical know-how on frontend, AI tools and software development.
Verified analysis of the August 28, 2026 attack on @7nohe/openapi-react-query-codegen: 10 malicious versions, GitHub Actions issue_comment abuse, npm Trusted Publishing, valid provenance, binding.gyp, IOCs, remediation and the distinction from TanStack Query.
A verified analysis of the July 2026 OpenAI and Hugging Face incident: ExploitGym, roughly 1,200 agents, more than 70,000 messages, about 700 agents in the Hugging Face workstream, reward hacking, 41 workers, root access, 956 secrets, transcript spoofing and OpenAI's response.
DNS and TLS form one operational chain of trust even though they solve different problems. DNS answers where a service is located. TLS confirms which server the client reached and whether the connection is protected. A mistake in either layer can invalidate an otherwise correct setup.
An enterprise asks for “one security scanner”, but the real requirement normally contains several independent problems:
HTTP security headers let a server tell the browser how scripts may be loaded, whether a page may be embedded, which device capabilities may be used, how much referrer information should be sent, how MIME types must be interpreted and whether the site may ever be reached over plain HTTP. A well-designed policy reduces the impact of several classes of attacks, including cross-site scripting, clickjacking, MIME confusion, XS-Leaks and unsafe cross-origin embedding.
For several years, the industry prepared for one clear scenario: Chrome would gradually remove third-party cookies, while Privacy Sandbox APIs would replace some advertising, measurement and identity use cases.
Most incidents are not sophisticated attacks. They are old problems, outdated software, reused passwords, exposed admin panels, that never got addressed. These are the fundamentals that prevent the majority of trouble.
