# Sanitization A security process that cleans or filters input by removing, replacing, or modifying potentially dangerous characters or content according to a security policy. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## From 750 Hours to 2 Hours: AI-Powered Security Triage at Razorpay DevFeed: [From 750 Hours to 2 Hours: AI-Powered Security Triage at Razorpay]() Original publisher: [Read original article]() Author: Prathamesh Joshi Published: 2026-06-09T14:56:35Z Content type: article Language: en Sources: [Razorpay Engineering - Medium]() Topics: [Security](), [Artificial Intelligence](), [Vulnerabilities](), [Architecture & Design](), [Code](), [API](), [GitHub](), [Sanitization](), [API keys]() Tags: [ai](), [api](), [architecture](), [code](), [credentials](), [github](), [hardcoded-credentials](), [sast](), [security](), [vulnerabilities]() ### AI overview Razorpay describes an AI-powered security triage system built to reduce the manual workload caused by large volumes of SAST, dependency, and secret-detection alerts. Its first live layer retrieves issue context, source code, data flows, and sanitization logic to distinguish genuine vulnerabilities from false positives, with reported accuracy of 75-80%. ### Source excerpt Co-authors: Mahlaqahaque Mh, Keertiv, Hari Prasad Pujari How we taught AI to read code like a senior security engineer Every day, Razorpay engineers ship thousands of lines of code. Every line births new security findings. SAST scanners flag suspicious patterns. Dependency checkers find vulnerable libraries. Secret detection tools catch hardcoded credentials. The alerts pile up. Hundreds become thousands. The backlog becomes noise. We hit a breaking point. Developers faced security ticket counts climbing into the thousands, with most of them turning out to be false positives. The classic "alert that cried wolf" scenario played out daily. When everything is marked critical, nothing is. Developers stopped trusting security findings altogether. Security engineers weren't having a better time. Validating issues manually while fielding constant ad-hoc requests from frustrated developers. Trying to stop a waterfall with a teaspoon. The human bottleneck became the limiting factor in our security posture. The core problem was simple. Traditional static analysis tools excel at finding patterns that might be vulnerabilities. They lack context. They can't distinguish between a properly sanitized SQL query and a vulnerable one. Between a test API key and a production secret. Between a dangerous data flow and one protected by business logic. For every 10 alerts, 7-8 were false positives. Manual triage became the bottleneck. Security couldn't scale with engineering velocity. That's when we built what we call the Autonomous Security Special Ops system. An AI-powered engine that handles the heavy lifting so humans can focus on what actually matters. The Three-layer Intelligence System Rather than throwing more human hours at the problem, we built an AI architecture operating in three layers. L1: Context-Aware AI Triage (Live). Our intelligent first responder. Powered by 29 specialized sub-skills , it reads code context like a senior security engineer. When a SAST finding lands, L1 ## How to Mitigate SSRF Vulnerabilities in Go DevFeed: [How to Mitigate SSRF Vulnerabilities in Go]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-12-10T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Go Language](), [Vulnerabilities](), [Sanitization](), [Security](), [HTTP](), [snyk-code]() Tags: [awareness](), [blog](), [code-security](), [developer](), [devrel](), [go](), [how-to](), [http](), [security](), [sensitive-data](), [snyk-code](), [validation](), [vulnerabilities]() ### AI overview This tutorial explains how Server-Side Request Forgery (SSRF) can affect Go applications that make HTTP requests based on user input. It presents URL parsing, input validation and sanitization, and trusted-host allowlists as mitigation techniques, with example code for securing an HTTP request handler. ### Source excerpt Dive into Server-Side Request Forgery (SSRF) vulnerabilities in Go applications and explore mitigation techniques. Learn how to secure your Go code and leverage tools like Snyk Code for proactive security. ## What you should know about PHP code security DevFeed: [What you should know about PHP code security]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-09-04T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [PHP](), [code security](), [Vulnerabilities](), [Sanitization](), [web applications](), [SQL](), [Laravel](), [WordPress](), [Databases]() Tags: [awareness](), [blog](), [code](), [code-security](), [developer](), [devrel](), [env-file-security](), [laravel](), [php](), [security](), [snyk-code](), [sql](), [vulnerabilities](), [web-applications](), [web-development](), [wordpress]() ### AI overview An overview of PHP code security, covering common causes of vulnerabilities, SQL injection risks, input sanitization, prepared statements, secure coding, dependency and infrastructure scanning, and the business consequences of breaches. ### Source excerpt Let's discuss the importance of PHP security and the business impact of some notable PHP interpreter vulnerabilities that are crucial for developers to get right. ## Building a Real-Time Chat Application with WebSockets DevFeed: [Building a Real-Time Chat Application with WebSockets]() Original publisher: [Read original article]() Author: admin Published: 2024-05-06T07:40:48Z Content type: tutorial Language: en Sources: [Posts on Chris Banes]() Topics: [WebSocket](), [real-time](), [Socket.IO](), [App](), [Node.js](), [servers](), [browser](), [Security](), [client](), [Sanitization](), [Authentication](), [Authorization]() Tags: [app](), [authentication](), [authorization](), [browser](), [building](), [code](), [node](), [real-time](), [scalability](), [security](), [uncategorized](), [websocket](), [xss]() ### AI overview This tutorial explains how to build a real-time chat application with WebSockets and Socket.IO. It covers the two-way browser-server connection, a basic Node.js server that broadcasts chat messages, client-side message handling, and security considerations including input sanitization, authentication, authorization, and XSS prevention. ### Source excerpt Have you ever wished your online chats felt more like actual conversations, without needing to constantly refresh the page for new messages? If so, WebSockets are the answer! WebSockets let you build real-time chat apps where messages flow instantly. Unlike regular websites, WebSockets keep a connection open between your app and the server. That means [...] ## Preventing SQL injection attacks in Node.js DevFeed: [Preventing SQL injection attacks in Node.js]() Original publisher: [Read original article]() Author: Lucien Chemaly Published: 2024-02-20T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Node.js](), [Security](), [SQL](), [Express](), [PostgreSQL](), [Sanitization](), [Vulnerabilities](), [web applications]() Tags: [acquisition](), [application-security](), [attacks](), [blog](), [code-security](), [developer](), [draftdotdev](), [javascript](), [node](), [node-js](), [postgresql](), [security](), [server](), [snyk](), [snyk-code](), [snyk-open-source](), [sql](), [validation](), [vulnerabilities]() ### AI overview This article explains how SQL injection attacks affect Node.js applications when user input is incorporated into SQL queries without proper validation, sanitization, or safe query construction. It demonstrates the issue with an Express application connected to PostgreSQL and introduces ways to protect applications from unauthorized access and data leakage. ### Source excerpt In this article, you'll learn more about why SQL injection attacks pose a significant threat and how to shield your Node.js applications against them. ## Idiomatic Kotlin: Solving Advent of Code Puzzles, Passport Validation DevFeed: [Idiomatic Kotlin: Solving Advent of Code Puzzles, Passport Validation]() Original publisher: [Read original article]() Author: Sebastian Aigner Published: 2021-09-01T14:52:59Z Content type: tutorial Language: en Sources: [Kotlin]() Topics: [Kotlin](), [Advent of Code](), [Programming](), [Sanitization]() Tags: [100daysofcode](), [advent-of-code](), [adventofcode](), [code](), [codenewbie](), [coding](), [community](), [development](), [engineering](), [files](), [inclusive](), [kotlin](), [linux](), [macos](), [software](), [validation]() ### AI overview A tutorial on solving Advent of Code 2020 Day 4, Passport Processing, with Kotlin. It explains how to parse passport records separated by blank lines, extract key-value pairs, and count passports containing all required fields. ### Source excerpt Today in "Idiomatic Kotlin", we're looking at day 4 of the Advent of Code 2020 challenges, in which we tackle a problem that feels as old as programming itself: input sanitization and validation. Day 4. Passport processing We need to build a passport scanner that, given a batch of input text, can count how many passports are valid. You can find the complete task description at https://adventofcode.com/2020/day/4. Like many challenges, we first inspect our input: ecl:gry pid:860033327 eyr:2020 hcl:#fffffd byr:1937 iyr:2017 cid:147 hgt:183cm iyr:2013 ecl:amb cid:350 eyr:2023 pid:028048884 hcl:#cfa07d byr:1929 hcl:#ae17e1 iyr:2013 eyr:2024 ecl:brn pid:760753108 byr:1931 hgt:179cm The input is a batch of travel documents in a text file, separated by blank lines. Each passport is represented as a sequence of key-colon-value pairs separated by spaces or newlines. Our challenge is finding out how many passports are valid. For part one, "valid" means that they need to have all the required fields outlined by the security personnel: byr, iyr, eyr, hgt, hcl, ecl and pid (we conveniently ignore their request to validate the cid field). Solving Day 4, Part 1 Like many challenges, we start by reading our puzzle input as text and trim off any extraneous whitespace at the beginning and the end of the file. As per the description, passports are always separated by blank lines. A blank line is just two "returns", or newlines, in a row, so we'll use this to split our input string into the individual passports: val passports = File("src/day04/input.txt") .readText() .trim() .split("\n\n", "\r\n\r\n") (Note that depending on your operating system, the line separator in text files is different: On Windows, it is \r\n, on Linux and macOS, it's \n. Kotlin's split method takes an arbitrary number of delimiters, allowing us to cover both cases directly.) We now have a list of passport strings. However, working with lists of raw strings can quickly get confusing. Let's use Kotlin's expressiv ## Learning Angular: Conditionally add styles to an element DevFeed: [Learning Angular: Conditionally add styles to an element]() Original publisher: [Read original article]() Published: 2016-01-24T00:00:00Z Content type: tutorial Language: en Sources: [Juri Strumpflohner]() Topics: [Angular](), [CSS](), [Document Object Model (DOM)](), [Sanitization](), [Security](), [XSS]() Tags: [angular](), [code](), [components](), [css](), [egghead](), [how-to](), [javascript](), [learning](), [xss]() ### AI overview This tutorial explains several ways to conditionally apply styles and CSS classes to DOM elements in Angular version 2 or later. It covers direct style binding, style sanitization for dynamically supplied background images, NgClass, single-class syntax, and applying classes to components. ### Source excerpt Lorem ipsum dolor sit amet ## Building a Rack Middleware DevFeed: [Building a Rack Middleware]() Original publisher: [Read original article]() Author: Shopify Engineering Published: 2013-09-04T20:46:00Z Content type: tutorial Language: en Sources: [Shopify Engineering](), [Shopify Engineering - Shopify Engineering]() Topics: [Authentication](), [Sanitization](), [Forms](), [Exception](), [Code]() Tags: [authentication](), [bug](), [code](), [forms](), [how-to](), [shopify]() ### AI overview A Shopify developer describes an authentication-related bug caused by invalid form submissions in an application. The article explains how a Rack middleware placed before OmniAuth can sanitize or reject malformed shop data and outlines a strategy-based implementation approach. ### Source excerpt I'm Chris Saunders, one of Shopify's developers. I like to keep journal entries about the problems I run into while working on the various codebases within the company. Recently we ran into a issue with authentication in one of our applications and as a result I ended up learning a bit about Rack middleware. I feel that the experience was worth sharing with the world at large so here's is a rough transcription of my entry. Enjoy! ## The Difference Between :x:element and :x:primitive DevFeed: [The Difference Between :x:element and :x:primitive]() Original publisher: [Read original article]() Author: Codebeforethehorse Published: 2012-11-10T18:16:00Z Content type: tutorial Language: en Sources: [Stefan Parker]() Topics: [XSS](), [Sanitization](), [HTML](), [JSON](), [html elements](), [Ajax]() Tags: [foreach](), [function](), [html](), [html-elements](), [json](), [payload](), [protection](), [render](), [rest](), [xhp](), [xss]() ### AI overview This article explains when to use :x:element versus :x:primitive in XHP. It recommends :x:element for most cases because its render() method produces more XHP and supports recursive rendering, while :x:primitive ultimately stringifies the result. It identifies custom HTML nodes and non-HTML output such as JSON AJAX responses as the main reasons to use :x:primitive. ### Source excerpt I was recently asked to clarify the differences between :x:element and :x:primitive, and when to use each one. It's actually pretty simple; the basic rule of thumb is this: always use :x:element. If you're only doing simple things in XHP you can stop reading now, but for the rest of you I'll get into the rare instances where you might use :x:primitive. First, the main difference. :x:element implements the render() method, which returns more XHP while :x:primitive implements to stringify() method, which returns a string. When you echo XHP to the page, it recursively calls render() on itself until it returns an :x:primitive. It will continue to do this to any children of an :x:primitive as well. Once the entire tree is just :x:primitives (usually meaning just HTML nodes) it stringify()s it. So why the difference? The big reason was that we can put XSS protection in all HTML elements and so long as you just return HTML nodes you'll never have to worry about input sanitization again. There are two cases where you would want to create an :x:primitive though. The first being if you wanted to create a custom HTML node. Let's say you wanted to create a tag for your own purposes. All you would need to do is extend :xhp:html-element (which extends :x:primitive) and define its tag name. class :foo extends :xhp:html-element { protected $tagname = 'foo'; } Pretty simple. You could define custom attributes and children restrictions too if you so desired. The other reason you would extend :x:primitive is if you wanted to return something other than HTML. Consider an AJAX response that returns a JSON object. You might construct an object that behaves like this: class :ajax:response extends :x:primitive { attribute array payload; attribute array errors; protected function stringify() { $html = ''; foreach ($this->getChildren() as $child) { $html .= :x:base::renderChild($child); } $response = array( 'payload' => $this->getAttribute('payload'), 'errors' => $this->getAttribute('e