Eva Sarafianou

Product Security Engineering Lead @ Mattermost - Web Security - Identity

[Eva Sarafianou @evileve6]

@BarcelonaBsides Are the dates going to be announced before March 30th? Not knowing the dates doesn't help with submitting CFPs.

[AI Security Engineers @aiseceng]

.@evileve6 at @auth0 shares the lessons she learned from scaling a product security program from startup to acquisition.

"Security partnerships may have scaling issues, but investing in Security Champions is the key!" 🔑

#DSC24

🔗: https://t.co/w1WIvcMmOr

[Liran Tal @liran_tal]

It's DevSecCon 24 tomorrow!

@mattj_io is hosting the EMEA section with some amazing speakers, and the agenda is overall amazing with talks from @shehackspurple @ottimorosi @_SteveGiguere_ @rotembar @joniklippert @evileve6 and so many others

RSVP quick 👉 https://t.co/slyYA72Qkw

[Eva Sarafianou @evileve6]

Join me on June 14th at DevSecCon24!

[AI Security Engineers @aiseceng]

DSC24 Speaker spotlight 🔦:
@evileve6 teaches how to run a Product Security program, including where to focus and how to cultivate a security culture! Register now - https://t.co/wSuGR5ZIsZ

[Auth0 @auth0]

Since the Log4J vulnerability news broke, Auth0 has been reviewing our platform for potential exposure. And at this time, we see no direct impact on the Auth0 Identity Platform. We will continue to monitor and investigate the situation.

[Eva Sarafianou @evileve6]

@marcin_hoppe @vickyjo @gsuberland Hi @gsuberland, happy to help

[Eva Sarafianou @evileve6]

My speaker's #FTWConf swag box arrived and it's full of goodies. Thank you @auth0 and @Microsoft!

As a reminder, my #threatmodeling talk recording is available at https://t.co/1htZ77keZh.

[Eva Sarafianou @evileve6]

@agonzalezro @auth0 Thanks Alex!

[ÁLE𝕏 @agonzalezro]

This post about secrets storage in the browser by
@evileve6 from @auth0 is top-notch 👌🏽 https://t.co/XidWaMP5mE

[Eva Sarafianou @evileve6]

@mosspilot Thank you Jeff!

[Eva Sarafianou @evileve6]

I passed the #aws Certified #Security - Specialty exam this week. Expect a blog about the studying and exam experience soon!

[Eva Sarafianou @evileve6]

@marcin_hoppe Thanks!

[Eva Sarafianou @evileve6]

Join me tomorrow at FTWConf where we'll celebrate the International Women's Day!

I'll be speaking about Threat Modeling and how it can help shift security left.

The talk is introductory level, no prior experience to Threat Modeling is needed.

#ftwconf #threatmodeling

[Ana Cidre @AnaCidre_]

✨Meet @evileve6 a Senior Product Security Engineer @auth0 in this clip Eva talks about how she got to where she is today.

Eva will be speaking about Threat Modeling in the “Shift Security Left” era at https://t.co/fDL9e2rolV

For the whole interview -> https://t.co/dMhQMRqZrh

[Eva Sarafianou @evileve6]

@disclose_io If it's an open source project with no https://t.co/YwUHfYC3gV file, also look at who are the active maintainers and try to find their email in GitHub, Twitter, LinkedIn etc.

In any case, never open an issue.

[Eva Sarafianou @evileve6]

@disclose_io 3. Check if company's website <DOMAIN>/security has a place for responsible disclosure
4. If non of the above are successful, check if there is a security email, e.g. security@<domain>. If there is one, also check if they have PGP in case the security issue is critical

(2/2)

[Eva Sarafianou @evileve6]

@gplusdotgr 3. The vulnerable code causing the XSS attack is not part of the module
4. No globally defined (e.g. JS native) function is used within the module that handles the variable holding the secret
This is indeed similar to what I describe in the closures examples (#3 and #4).

(2/2)

[Eva Sarafianou @evileve6]

@gplusdotgr This could work in some cases where all of the following hold true:
1. The variable holding the secret is not exported
2. Any function manipulating the secret within the closure is not exported. Otherwise function override attacks can occur
(1/2)