# contentlab Published articles for contentlab. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up? DevFeed: [JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up?]() Original publisher: [Read original article]() Author: John Carione Published: 2026-04-23T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Resilience](), [Security](), [snyk-iac](), [supply-chain-security](), [vulnerability](), [Infrastructure as code](), [Open Source](), [AI Development](), [releases](), [pull-requests](), [Code]() Tags: [ai](), [ai-development](), [awareness](), [blog](), [cloud-security](), [code](), [contentlab](), [developer](), [devops](), [executive](), [iac-security](), [interest](), [open-source](), [open-source-security](), [pull-requests](), [releases](), [resilience](), [sbom](), [secrets](), [security](), [snyk-cloud](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain-security](), [vulnerability]() ### AI overview JPMorganChase's 10-point cyber resilience checklist addresses enterprise security priorities spanning software versions, open-source dependencies, SBOMs, build pipelines, secrets, infrastructure as code, and AI development. The article explains how Snyk covers eight of the ten actions through developer workflows and its security platform. ### Source excerpt JPMorganChase published a 10-point cyber resilience checklist. See how Snyk covers 8 of the 10 actions and where it fits in your security stack. ## A commitment to future generations: Snyk's 2024 Student Edition Capture The Flag Recap DevFeed: [A commitment to future generations: Snyk's 2024 Student Edition Capture The Flag Recap]() Original publisher: [Read original article]() Author: Michael Biocchi Published: 2024-11-21T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [ctf](), [Cybersecurity](), [Application Security](), [snyk-learn](), [Vulnerabilities](), [DevSecOps]() Tags: [2025](), [application-security](), [awareness](), [blog](), [contentlab](), [ctf](), [cybersecurity](), [developer](), [devsecops](), [free](), [learn](), [snyk](), [snyk-learn](), [training](), [vulnerabilities]() ### AI overview Snyk recaps its 2024 student Capture The Flag 101 Workshop, which brought together students from more than 100 schools for hands-on cybersecurity training. The article describes CTFs as practical exercises covering application security, network vulnerabilities, cryptography, and related skills, and outlines Snyk Learn's commitment to providing free training and additional student opportunities in 2025. ### Source excerpt Looking to boost your cybersecurity skills? Snyk's CTF 101 Workshop offers a hands-on introduction to Capture the Flag competitions, empowering students to tackle real-world security challenges. Learn about application security, network vulnerabilities, and more through free, engaging training. ## Symmetric vs. asymmetric encryption: Practical Python examples DevFeed: [Symmetric vs. asymmetric encryption: Practical Python examples]() Original publisher: [Read original article]() Author: Josh Amata Published: 2024-05-15T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Encryption](), [Cryptography](), [Python](), [SSL](), [TLS (Transport Layer Security)]() Tags: [application-security](), [awareness](), [best-practices](), [blog](), [code-security](), [contentlab](), [cryptography](), [data-transmission](), [developer](), [encryption](), [examples](), [guide](), [implement](), [open-source-security](), [python](), [security](), [snyk-code](), [snyk-open-source](), [ssl](), [tls]() ### AI overview This tutorial explains symmetric and asymmetric encryption, including how each uses cryptographic keys to protect sensitive data. It provides practical Python examples and discusses applications in secure transmission, storage, messaging, and TLS/SSL handshakes. ### Source excerpt In this guide, we'll discuss symmetric and asymmetric encryption, implement them in Python, and explore their best practices. ## File encryption in Python: An in-depth exploration of symmetric and asymmetric techniques DevFeed: [File encryption in Python: An in-depth exploration of symmetric and asymmetric techniques]() Original publisher: [Read original article]() Author: Keshav Malik Published: 2023-11-22T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Encryption](), [Python](), [Cryptography](), [Amazon Web Services](), [SDKs](), [Command-line interface]() Tags: [amazon-web-services](), [application-security](), [awareness](), [blog](), [contentlab](), [cryptography](), [developer](), [encryption](), [engineering](), [kms](), [python](), [security](), [techniques](), [tutorial]() ### AI overview This tutorial explains symmetric and asymmetric file encryption in Python. It covers symmetric encryption with Amazon KMS and PyNaCl SecretBox, then introduces asymmetric encryption with PyNaCl's public/private box, including the prerequisites and packages needed to follow along. ### Source excerpt This article dives into the world of encryption in Python. For symmetric encryption, we'll focus on Amazon's Key Management Service (KMS) and PyNaCl SecretBox. Then, we'll look at asymmetric encryption and PyNaCl's public/private box. ## Getting started with query parameterization DevFeed: [Getting started with query parameterization]() Original publisher: [Read original article]() Author: Mary Gathoni Published: 2023-10-24T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [SQL](), [Security](), [Databases](), [web applications]() Tags: [acquisition](), [article](), [attacks](), [blog](), [code](), [code-security](), [contentlab](), [developer](), [how-to](), [security](), [snyk-code](), [sql]() ### AI overview A hands-on article explaining SQL query parameterization as a defense against SQL injection in web applications. It describes using placeholders, prepared statements, and parameterized stored procedures so user input is treated as data rather than executable SQL, while also discussing permissions and potential performance benefits. ### Source excerpt In this hands-on article, we'll review how to leverage SQL query parameterization and stored procedures to prevent injection attacks, as well as some additional security measures that help keep our code safe. ## How to protect Node.js apps from CSRF attacks DevFeed: [How to protect Node.js apps from CSRF attacks]() Original publisher: [Read original article]() Author: Victor Ikechukwu Published: 2023-10-17T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Node.js](), [Vulnerabilities](), [Security](), [web applications](), [browser]() Tags: [application-security](), [attacks](), [blog](), [code-security](), [contentlab](), [cookies](), [how-to](), [javascript](), [node](), [node-js](), [security](), [snyk-code](), [snyk-open-source](), [vulnerability](), [web-applications]() ### AI overview This tutorial explains cross-site request forgery (CSRF) attacks against Node.js applications. It describes how attackers exploit trust in authenticated browser sessions, session IDs, and cookies to trigger unauthorized actions, then introduces practical protection methods, testing approaches, code examples, and security best practices. ### Source excerpt Victor Ikechukwu October 17, 2023 A cross-site request forgery attack (CSRF) attack is a security vulnerability capitalizing on trust between a web browser and a legitimate website. Crafty attackers manipulate browsers into executing malicious actions on websites where users authenticate themselves and log in. Often, these attacks start when users click a link attached to a deceptive email or land on a compromised website, unaware of the logic executing in the background. ## Installing and managing Java on macOS DevFeed: [Installing and managing Java on macOS]() Original publisher: [Read original article]() Author: Keshav Malik Published: 2023-10-12T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [macOS]() Tags: [article](), [awareness](), [blog](), [contentlab](), [developer](), [engineering](), [guide](), [how-to](), [installation](), [java](), [jdk](), [macos](), [reviews]() ### AI overview A guide to installing and managing multiple Java versions on macOS, including manual installation, distribution choices, compatibility testing, and configuring environment variables such as JAVA_HOME. ### Source excerpt This article reviews how to install and manage different versions of Java on your macOS system to help you simplify this process. ## Security implications of cross-origin resource sharing (CORS) in Node.js DevFeed: [Security implications of cross-origin resource sharing (CORS) in Node.js]() Original publisher: [Read original article]() Author: Victor Ikechukwu Published: 2023-09-13T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Node.js](), [Vulnerabilities](), [web applications](), [JavaScript](), [Code]() Tags: [acquisition](), [application-security](), [awareness](), [best-practices](), [blog](), [code](), [code-security](), [contentlab](), [data-breaches](), [developer](), [http](), [javascript](), [node-js](), [security](), [snyk-code](), [snyk-open-source](), [vulnerabilities](), [web](), [web-applications]() ### AI overview This article explains how cross-origin resource sharing (CORS) enables web applications to communicate across origins while working around same-origin policy restrictions. It uses a Node.js code sample to discuss CORS implementation, security risks such as data breaches and unauthorized access, best practices, and security testing. ### Source excerpt This article will cover what CORS is and some of its use cases, as well as best practices for using CORS and testing the security of your code. ## How to avoid web cache poisoning attacks DevFeed: [How to avoid web cache poisoning attacks]() Original publisher: [Read original article]() Author: Najia Gul Published: 2023-09-11T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Caching](), [Vulnerabilities](), [Security Attacks](), [web applications](), [Security]() Tags: [application-security](), [attacks](), [awareness](), [blog](), [cache](), [caching](), [cdn](), [contentlab](), [security](), [web-applications]() ### AI overview An article explaining web cache poisoning attacks, how caching works across browsers, servers, and CDNs, and how improper cache management can create security risks for web applications. ### Source excerpt In this article, we'll comprehensively explore web cache poisoning attacks and how they work. We'll also discuss the most effective mitigation strategies to help safeguard our web applications. ## How to implement SSL/TLS pinning in Node.js DevFeed: [How to implement SSL/TLS pinning in Node.js]() Original publisher: [Read original article]() Author: Nwani Victory Published: 2023-08-29T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Node.js](), [Vulnerabilities]() Tags: [acquisition](), [application-security](), [attacks](), [blog](), [code-security](), [contentlab](), [developer](), [how-to](), [javascript](), [node-js](), [open-source-security](), [security](), [snyk-code](), [snyk-open-source](), [ssl](), [tls](), [vulnerabilities]() ### AI overview A tutorial on implementing SSL/TLS certificate pinning in Node.js to help defend connections against MITM and certificate-related attacks. ### Source excerpt This article explains certificate pinning, highlighting its benefits and use cases in Node.js applications. ## Top 5 VS Code extensions for security DevFeed: [Top 5 VS Code extensions for security]() Original publisher: [Read original article]() Author: Brian Clark Published: 2023-08-24T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Visual Studio Code](), [passwords]() Tags: [awareness](), [best-practices](), [blog](), [code-security](), [contentlab](), [developer](), [extensions](), [javascript](), [passwords](), [secrets](), [security](), [vs-code]() ### AI overview The article presents VS Code extensions for improving application security and security practices. Its shown section covers the 1Password extension, which helps developers store, detect, and retrieve passwords and secrets without leaving the editor. ### Source excerpt This article highlights the top five VS Code extensions to help us write more secure code and maintain security best practices. ## Does GitOps enhance application security? DevFeed: [Does GitOps enhance application security?]() Original publisher: [Read original article]() Author: Vandana Verma Sehgal Published: 2023-08-21T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [CI/CD](), [ci]() Tags: [application-security](), [awareness](), [blog](), [ci](), [ci-cd](), [contentlab](), [deployment](), [developer](), [devops](), [docker](), [git](), [infrastructure-as-code](), [kubernetes](), [security]() ### AI overview The article explains GitOps principles and their role in application security. It describes declarative configuration, Git-based version control, automated change approvals, and continuous reconciliation for CI/CD and infrastructure delivery. ### Source excerpt In this post, we'll explore GitOps' core principles, how they enhance application security, and how GitOps' rapid-change deployment process helps increase efficiency. ## Mitigating DOM clobbering attacks in JavaScript DevFeed: [Mitigating DOM clobbering attacks in JavaScript]() Original publisher: [Read original article]() Author: Keshav Malik Published: 2023-08-07T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Document Object Model (DOM)](), [JavaScript](), [Application Security](), [web applications](), [Vulnerabilities](), [HTML]() Tags: [application-security](), [attacks](), [awareness](), [blog](), [browser](), [code-security](), [contentlab](), [developer](), [html](), [html-elements](), [javascript](), [security](), [snyk-code](), [snyk-open-source](), [time](), [web-applications](), [xss]() ### AI overview This article explains DOM clobbering, a condition in which HTML element IDs or name attributes conflict with global JavaScript variables or functions. It describes how browsers create global variables from these attributes, how conflicts can overwrite existing functions, and how attackers may exploit the behavior to cause unpredictable behavior or security vulnerabilities such as cross-site scripting (XSS). ### Source excerpt This article explores the concept of DOM clobbering and provides strategies for building more secure and robust web applications. ## WebAssembly Security Concerns and Risk Mitigation DevFeed: [WebAssembly Security Concerns and Risk Mitigation]() Original publisher: [Read original article]() Author: Marcelo Oliveira Published: 2023-07-28T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [WebAssembly](), [Security](), [Blazor]() Tags: [application-security](), [awareness](), [blog](), [code-security](), [contentlab](), [developer](), [javascript](), [security](), [snyk-code](), [snyk-open-source]() ### AI overview This tutorial introduces WebAssembly security considerations and uses a sample Blazor application to examine WebAssembly-specific security issues. It explains setup with Visual Studio or VS Code and a Snyk extension for security analysis. ### Source excerpt Developers are embracing WebAssembly for its ability to accelerate complex algorithms, enable gaming and multimedia applications, and provide a secure sandbox. But before adopting WebAssembly, it's crucial to consider its security implications and how to mitigate the risks. ## Finding and fixing insecure direct object references in Python DevFeed: [Finding and fixing insecure direct object references in Python]() Original publisher: [Read original article]() Author: Keshav Malik Published: 2023-07-19T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Python](), [Vulnerabilities](), [Access Control](), [Security](), [web applications](), [API]() Tags: [access-control](), [acquisition](), [api](), [application-security](), [authorization](), [blog](), [code](), [code-security](), [contentlab](), [developer](), [open-source-security](), [python](), [security](), [snyk-code](), [snyk-open-source](), [vulnerabilities](), [web]() ### AI overview This article explains insecure direct object references (IDOR) in Python applications. It describes how missing authorization checks can let attackers access or modify sensitive objects, files, or user data, and outlines common IDOR patterns, including blind IDORs and guessable identifiers. ### Source excerpt In this post, we'll review common patterns and types of IDOR vulnerabilities and how to protect against them. ## Best practices for effective attack surface analysis DevFeed: [Best practices for effective attack surface analysis]() Original publisher: [Read original article]() Author: Benson Kuria Macharia Published: 2023-07-18T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Vulnerabilities](), [supply-chain-security](), [Microservice](), [Microservices](), [Network](), [Open Source](), [Authentication]() Tags: [analysis](), [article](), [authentication](), [awareness](), [best-practices](), [blog](), [contentlab](), [devsecops](), [malware](), [microservices](), [open-source](), [security](), [snyk-platform](), [snyk-security-intel](), [supply-chain-security](), [vulnerabilities]() ### AI overview This article explains attack surface analysis as the process of identifying and assessing vulnerabilities and risks across an application or network. It presents a two-step approach: map attack surfaces and rank the severity of potential breaches, while considering interfaces, communication paths, attack vectors, authentication, microservices, open-source and third-party components, continuous monitoring, license compliance, and supply-chain security. ### Source excerpt This article reviews several best practices we can implement to make an attack surface analysis more effective. ## XS leaks: What they are and how to avoid them DevFeed: [XS leaks: What they are and how to avoid them]() Original publisher: [Read original article]() Author: Gino Diño Published: 2023-07-17T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [web applications]() Tags: [api](), [application-security](), [attacks](), [awareness](), [blog](), [browser](), [code-security](), [contentlab](), [developer](), [how-to](), [javascript](), [security](), [snyk-code]() ### AI overview The article explains cross-site leaks (XS leaks), web security vulnerabilities that can expose sensitive data from a user's activity on other websites. It describes how browser and web features can be exploited, including timing attacks involving cross-origin requests, and introduces prevention examples. ### Source excerpt In this article, we'll dive deeper into what XS leaks are and how they occur. Then, we'll review some hands-on examples of how to prevent them.