os_car_rsæ

Building apps & security tools from 🇿🇦 | Shipping in public | Code, cyber, and the occasional football take

[os_car_rsæ @PocoOscar]

@mrtbrgl Yes, I’ll follow back

[os_car_rsæ @PocoOscar]

@con_golias Before npm install on a machine that holds agent credentials: read the package's postinstall. If it writes into ~/.claude or similar without asking, that's a supply-chain footgun dressed as DX.

Treat agent config dirs like you treat .ssh.

[os_car_rsæ @PocoOscar]

@koxy_Dev This one trips people up in Node especially: verify the signature against the raw request body, not the re-serialized JSON.

One whitespace difference and your HMAC never matches, so teams "fix" it by skipping verification. Don't.

[os_car_rsæ @PocoOscar]

Quick mental model I use:

API keys = machine-to-machine, long-lived, scoped tight
OAuth = delegated access with consent and refresh
JWT = a token format, not a security model on its own

You can (and often do) use JWT inside OAuth. Mixing them up is how teams ship the wrong threat model.

[os_car_rsæ @PocoOscar]

The bug that keeps showing up in app backends isn't fancy crypto.

It's an endpoint that checks you're logged in, then loads whatever ID the client sent.

Auth proves who you are. Authorization proves you own that resource. Don't skip the second check.

[os_car_rsæ @PocoOscar]

https://t.co/SP2hRfvtNe

[os_car_rsæ @PocoOscar]

@dbShoubill .p8 key keeper is the one that keeps me up. That key is forever until you rotate it, and it lives in too many Slack threads. Store it like a production secret, not a zip on Drive.

[os_car_rsæ @PocoOscar]

@ThePracticalDev @dbalcare Prompt injection in a log file is a nasty reminder: anything an agent reads is an attack surface. Treat untrusted logs like untrusted user input. Same rules.

[os_car_rsæ @PocoOscar]

@LiveLoveSEO This. Revoke first, then rewrite history. I've seen teams git-filter the file and keep the same key live for days. Bots don't wait for your cleanup PR.

[os_car_rsæ @PocoOscar]

If your login flow dumps the refresh token into device logs "just for debugging", that token is now in every crash report and log dump you ship.

Strip auth material from production logging. Debug builds only. This one keeps biting teams.

[os_car_rsæ @PocoOscar]

@droidconke @wangerekaharun Contracts over conventions is how you keep Android and iOS from drifting into two apps. Same promise for deep links, auth tokens, and error shapes. Platform quirks belong behind the contract, not in every screen.

[os_car_rsæ @PocoOscar]

@hqmank This is the right layer. Once an agent can touch the filesystem, "don't paste keys" stops being enough. Local guardrails before the command runs beat hoping the model remembers your .env policy.

[os_car_rsæ @PocoOscar]

@patio11 This tracks for mobile too. Open-source SDKs get starred and still ship with hardcoded keys. Stars aren't reviews. Assume Very Few Eyes until you've actually read the code that touches auth and network.

[os_car_rsæ @PocoOscar]

Most phishing that fools your users doesn't look like a random site.

It looks like your brand on a lookalike domain you never claimed.

Grab the close spellings. Watch cert issuance for your name. Boring domain hygiene beats another banner that says "we take security seriously."

[os_car_rsæ @PocoOscar]

@redacteduser This is the pattern. Once you hand exchange API keys to a third-party app, you're trusting their whole stack. Withdraw-only keys, IP allowlists, and short-lived tokens aren't optional extras.

[os_car_rsæ @PocoOscar]

@realMikeChong Felt this. The RN upgrade treadmill is real. I still stick with Expo when the tooling saves more hours than the dep drama costs, but every major bump needs a dedicated QA pass, not a hope-and-pray merge.

[os_car_rsæ @PocoOscar]

@Robertookwu Permissions and network egress first. Does the SDK ask for more than it needs? Can it phone home to domains I don't control? Closed-source binaries are a harder yes too, because I can't see what lands in my app.

[os_car_rsæ @PocoOscar]

Hot take: jailbreak detection gets more airtime than the boring stuff that actually gets abused.

Open redirects in deep links. Tokens sitting forever in AsyncStorage. Auth APIs with permissive CORS.

Fix the dull holes first. Fancy checks come after.

[os_car_rsæ @PocoOscar]

@GauravBrief This one bites every mobile team eventually. I stash the intended route, finish auth, then resume navigation. Skip that and people land on home after login wondering where the link went.

[os_car_rsæ @PocoOscar]

@caseyjohnellis Same choice every time. Fancy memory-safety bugs make great conference talks, but "hi, can you reset this for me?" still opens more doors. App security fails more often at the human layer than the crypto layer.