Security

A lot happened in AI this week. Anthropic admitted its own models broke into real companies. The protocol behind AI agent tools rewrote its own rules. AMD bought a company that builds AI chips in a very strange way. And your API bill just got smaller. Here is everything that matters for developers, in one short read. 1. Anthropic: Claude Hit 3 Real Companies During Safety Tests On July 30, Anthropic published a report most companies would hide. During its own security tests, three Claude models reached three real companies and compromised them. ...

Redis is easy to start with and hard to run well at scale. This tutorial covers the practices that keep Redis fast, reliable, and secure in production. Key Naming Conventions Consistent key names make debugging and management much easier. Use colons as separators: app:entity:identifier:field Examples: user:1001:profile session:abc123 cache:product:5:details rate:api:user:1001 lock:order:processing:42 Rules: Use lowercase Prefer colons over dots or hyphens (Redis treats colons as namespace separators in RedisInsight) Keep keys short — they add up in memory Include a TTL on anything that should expire Memory Optimization Redis stores everything in RAM. Know what you are using: ...

On July 8, 2026, the security firm Wiz published research on a flaw they named GhostApproval. It is not one bug in one tool. It is the same design mistake, made independently, in six different AI coding agents: Amazon Q Developer, Claude Code, Cursor, Augment, Google Antigravity, and Windsurf (Wiz Research, The Hacker News). The trick behind it is over 40 years old. It is called a symlink. Once you understand what a symlink is, the whole story makes sense — and so does why fixing it is harder than it sounds. ...

Anthropic shipped a Claude Security plugin for Claude Code. It runs a team of agents over your repository, hunts for vulnerabilities, and writes a report. “AI finds bugs in your code” is a claim you should be suspicious of. So instead of reading the announcement, I read the plugin’s source. The interesting part is not the scanning. It is that the plugin does not let its own model decide how much to trust the results. ...

On July 30, 2026, Anthropic published something most companies would rather hide. Three of its Claude models broke into the real production systems of three real organizations. This happened during Anthropic’s own cybersecurity tests. Nobody told the models to attack real companies. The models thought they were playing a game. ...

A Kubernetes cluster has many attack surfaces. Misconfigured Pods can break out of their namespace. Overprivileged service accounts can access the entire cluster. Unscanned images can run with known vulnerabilities. This tutorial covers the essential security practices before taking any Kubernetes application to production. The 4Cs of Cloud Native Security Think of Kubernetes security in layers: Cloud → Cluster → Container → Code Code — vulnerabilities in your application code Container — image security, running as non-root, minimal base images Cluster — RBAC, Pod Security Standards, Network Policies Cloud — network firewall rules, IAM policies, cloud provider security Each layer depends on the one below it. Fixing only one layer is not enough. This tutorial focuses on the Container and Cluster layers. ...

You built the app. It works. But before you ship it, you need to think about security. Can someone decompile your APK and read your code? Is the user’s data safe? Can a man-in-the-middle attack steal API tokens? In this tutorial, you will learn how to protect your Android app — from code shrinking with R8 to biometric authentication and encrypted storage. Prerequisites: You should have a working Android app. If you have been following this series, you already have everything you need. ...

Most beginner Docker setups have serious security problems. Containers running as root. Passwords in Dockerfiles. Outdated base images with known vulnerabilities. No resource limits. This tutorial covers the most important Docker security practices. You do not need to implement all of them at once. Start with the first three — they will fix the most critical issues. 1. Never Run Containers as Root By default, processes inside Docker containers run as root (UID 0). If an attacker exploits a vulnerability in your app, they have root access inside the container — and potentially a path to the host. ...

Every time you see the padlock in your browser, two computers perform a secret handshake. They agree on a secret key — without ever sending that key across the internet. And your browser checks that the server really is who it claims to be. This post explains exactly how that works: HTTPS, the TLS handshake, keys, and certificates. In simple steps. The Problem: Plain HTTP Is Readable HTTP sends everything as plain text. Your password, your messages, your card number — all of it. ...

This is the final article in the Security for Developers series. It brings everything together into a single, actionable checklist you can use for every project. Bookmark this page and review it whenever you start a new project or prepare for a security review. How to Use This Checklist Each item is marked with a priority level: P0 (Critical): Do this before going to production. Skipping it means you are vulnerable. P1 (High): Do this within the first week of production. Important for security posture. P2 (Medium): Do this within the first month. Improves defense in depth. P3 (Low): Nice to have. Do when you have time. Authentication Checklist # Item Priority Details 1 Hash passwords with bcrypt or Argon2 P0 Never store plaintext. Use cost factor 12+ for bcrypt. 2 Enforce minimum password length of 8 characters P0 NIST recommends 8+ characters. Do not require special characters. 3 Use HTTPS for all authentication endpoints P0 Credentials in transit must be encrypted. 4 Implement account lockout after failed attempts P1 Lock after 5-10 failed attempts for 15-30 minutes. 5 Use JWT with short expiration (15-60 min) P1 Combine with refresh tokens for longer sessions. 6 Sign JWTs with RS256 or EdDSA (not HS256 for distributed) P1 Asymmetric signing prevents key sharing. 7 Store tokens in httpOnly cookies (not localStorage) P1 Prevents XSS from stealing tokens. 8 Implement refresh token rotation P1 Invalidate old refresh token on each use. 9 Validate JWT signature and expiration on every request P0 Never trust a token without validation. 10 Support multi-factor authentication (MFA) P2 TOTP or WebAuthn. SMS is better than nothing. 11 Check passwords against breached lists (Have I Been Pwned) P2 Reject passwords that appear in known breaches. 12 Log all authentication events P1 Successful and failed logins, password changes. Reference: Tutorial #2: Authentication ...