Lessons from Running a Product Security-Focused...
summary
Stanford runs a product-security clinic that gives two-hour engagements combining threat modeling, data-security reviews, cloud config checks and live testing, backed by a worksheet and NDAs. Common findings: Firebase/Supabase misconfigurations that let clients read other users’ data, exposed AWS keys that once triggered a $6,000 crypto-mining bill, IDOR and unprotected GraphQL schemas, and an RCE via command injection. The clinic automates checks for popular stacks and consistently finds at least one major flaw per engagement.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:28About the speakers
- 2:10Security clinics overview
- 3:54Stanford’s unique context
- 5:38From reactive to proactive
- 6:19Common vulnerabilities found
- 8:05Clinic engagement structure
- 13:47Success stories
- 16:59War stories and vulnerabilities
- 22:00Lessons learned
- 24:50Q&A session
related talks
34mHe Builds a SaaS Solution Without Caring About Security...
44mDeveloper Productivity Shouldn’t Breach Security
46mApplication security from start to finish
44mSecurity Lessons for Early Adopters
49mFrom Application Security to Developer Security
19mCritical Security Mistakes in Frontend Applications
36mHow to build continuous security and embed it in your product
41mWake Up, Neo