Day Zero — How to Build a Web App and Avoid Headline News
summary
A review of common security flaws found in legacy PHP web apps: concatenated SQL instead of prepared statements, hardcoded ID checks, leftover backup files and credentials from manual SCP deployments, exposed test servers and git repos with production secrets, plus insecure Docker images. It cites public incidents (compromised npm package, misconfigured S3, exposed MongoDB) and recommends automated scans, secret rotation, using prepared statements, regular pre-release audits and adopting OWASP ASVS.
AI-written summary · about
chapters (26)
- 0:00Introduction
- 1:04About me
- 2:33Dangerous legacy systems
- 5:032010 system origins
- 6:50Auth and integration flaws
- 8:17Basic security gaps
- 9:43OWASP Top 10 impact
- 11:50New framework threats
- 13:14SQL injection flaws
- 15:22Package misconfigurations
- 16:49Firebase and cloud misconfigs
- 17:30Default passwords danger
- 18:35JavaScript/npm threats
- 20:25Old servers and unused systems
- 21:50Unprotected public directories
- 22:33Front-end flaws and hidden risks
- 24:43Data leaks via forms
- 25:50Production data handling risks
- 27:58Test environment leaks
- 28:41Direct production changes
- 29:45Best practices and fixes
- 31:58Automation and threat response
- 32:38Developer responsibility
- 33:42Capture The Flag
- 34:47Security learning resources
- 35:30Summary and Q&A
related talks
51m10 things developers need to know about web application security
19mCritical Security Mistakes in Frontend Applications
52mPractical Security in Web Applications
02h 18mWeb application security (Part 2)
02h 14mWeb application security (Part 1)
59mPractical Security for Web Applications
10mIntroduction to web security
41mLive Hacking: Breaking into Your Web App