ls ~/writing --tag=owasp

[01]Writing · Tag

Articles tagged "owasp".

$ tag --stat owasp
Articles
2
Published
Apr 2026
Reading time
13 min
In series
1

Articles tagged owasp

6 min [security][supabase][auth-jwt]

User enumeration via password reset: the bug in default forgot-password flows

Most forgot-password endpoints leak whether an email exists. Fix: return the same response always, regardless of account status.

Supabase Production Hardening 5/8

user-enumeration-password-reset-leak--cover
Your forgot-password form will tell a stranger which of your customers have accounts.

7 min [security][supabase][edge-functions]

Origin validation in edge functions: the open redirect you ship by default

Edge functions that trust the Origin or Referer header for redirect URLs are open-redirect vulnerable. One allowlist helper closes the gap.

Supabase Production Hardening 4/8

origin-validation-edge-functions-open-redirect--cover
Your own domain hands the user to the attacker’s copy of your login page.

[02]Narrow it down

[03]Read in order

One series runs through this tag.

All articles