Counter-spells and the Art of Keeping Your Application Safe
summary
Ember escapes HTML by default so relying on ember string HTMLSafe is framed as a measurable risk, replaced with contextual components and DOM-based helpers that avoid triple-curly output; the talk advocates using content security policy v2 plus Robert Jackson’s ember-cli addon and always adding noopener noreferrer for target=_blank links. A concrete toolchain is built: an eslint blacklist rule that runs in dev with caching, cutting detection time from tens of seconds to ~1.3s. Intercom’s mature app ships 100+ deploys/day with 37 authors, 190 master commits, 892 file changes last week.
AI-written summary · about
chapters (8)
- 0:00Intro
- 1:33Storytime
- 5:02Intercom
- 6:41Prepare for battle
- 9:08Ember
- 17:56Writing Good Helpers
- 21:16Target Bank
- 24:41RealTime Feedback
related talks
20mCounter-spells and the art of keeping your application safe
30mThe Art of Keeping Your Application Safe
48mSecurity Risk: Single-Page Applications.
15mSafety Not Guaranteed
42mYou thought your React application is secure? Think again
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
43mAppSec is too hard!?
08mHack Proofing Your JavaScript A Fun And Engaging Guide To Enhancing Security