Sarat Lingamallu’s Post

Do not hardcode passwords or tokens in code (Secrets Management) 👩💻 In an era where data breaches are all too common, securing your secrets has never been more critical. As developers, we hold the keys to the kingdom - but are we doing enough to protect them?  This carousel dives into the essential dos and don'ts of secrets management, offering actionable insights for anyone looking to bolster their security posture.  Let's navigate through these best practices together and fortify our defenses against potential threats. ✅ Sarat Lingamallu Satheesh Challa #FlyingDuck #DotnetSecurity #SupplyChainSecurity #SBOM #SoftwareDevelopment #InnovationInTech

Hard coding secrets in the code is actually a very big issue and a frequent one than I initially thought. Developers often do that as part of their coding and sometimes its hard to control that despite security awareness and measures in place. We are surprised to see hundreds of secrets in some of the code we are scanning. Our product FLYINGDUCK identifies 100+ types of secrets in your code such as API keys, JWT tokens, Passwords, Email ids (yes Email id is a secret too per GDPR) etc. And the best part we DO NOT store any of those secrets on our product! It is a MUST to ensure that your secrets are secure. So let us know if we can help you to reduce this risk in your code. #secretsmanagement

Bredec Group Backdoor.Win32.Armageddon.r Exposed: Hardcoded Credentials Threaten Security - BNN Breaking: Backdoor.Win32.Armageddon.r Exposed: Hardcoded Credentials Threaten Security  BNN Breaking Inquiry@bredec.com

🔍 Recently completed security assessments on a VDP and uncovered a few interesting issues. It’s always rewarding to identify areas that can be fortified, helping to enhance overall application security. Continuing the journey of making the digital world a safer place! 🔒💡 #bugbounty #infosec #applicationsecurity #vulnerability #responsibledisclosure

#CyberAlerts SolarWinds has addressed 11 critical security vulnerabilities in its Access Rights Manager (ARM) software, potentially preventing unauthorized access to sensitive data and execution of arbitrary code. Of these flaws, seven are rated Critical with a CVSS score of 9.6, and the other four are rated High with a CVSS score of 7.6. Notable vulnerabilities include CVE-2024-23472, a directory traversal flaw allowing file deletion and information disclosure, and CVE-2024-28074, an internal deserialization remote code execution vulnerability. Read More: https://lnkd.in/eVjxzX44 #SolarWinds #Security #Vulnerabilities

This #CybersecurityAwarenessMonth we're proud to build a secure future with every line of code. Security is at the core of everything we build. Keeping your data and our systems safe is not just a priority, it’s a responsibility. Let's stay vigilant together! #StaySafeOnline #CyberAwareness #WebAppSecurity

🛡️Ensure your DApp #security and reliability with thorough #smartcontracts #audit🕵️♂️. Our expert team identifies and fixes vulnerabilities, protecting user #funds and enhancing #performance. Safeguard your DApp from #hacks today. #dapp🔒

Plain vanilla IT? No thanks! When it comes to business tech, settling for the bare minimum won't help you overcome challenges like slow performance, security vulnerabilities, or outdated systems. A great IT service provider is like adding a luscious strawberry topping to your plain vanilla ice cream – it takes everything to the next level. Why accept bland IT? Build a tech partnership that can transform your business. Comment "strawberry" to book a free consultation. Let one of our specialists help you enhance your IT experience. #TechUpgrade #BusinessTransformation #ITConsultation

🔒 New credential theft technique! ⛓ We demonstrated a subdomain takeover to steal credentials we found hiding in localStorage. What? 😱 🔑 Security Researcher Joseph Leon discovered orgs using #ReadMe for developer documentation often store users’ secrets in localStorage. 🚨Turns out, ReadMe is also vulnerable to subdomain takeovers. 👉 Read the Research: https://lnkd.in/gbXpM6K5 #TruffleHog #ReadMe #subdomaintakeover #CodeSecurity #DevCommunity #OpenSourceSecurity #cybersecurity #secretsmanagement  #securityawareness #datasecurity #infosec #appsec

🔐 Heads up, devs! Subdomain takeovers can lead to major credential leaks, as we explored in our latest blog post. I promise this one is quite interesting. Here’s the scoop: attackers can hijack subdomains, decrypt localStorage data, and exfiltrate secrets like API keys. Our advice? 1. Require additional DNS records to verify ownership. 2. Verify CNAME and TXT records. 3. Lock subdomains to the first account that registers them. 4. Regularly audit your DNS records and sanitize localStorage data. Stay proactive and keep your data safe! Full details in the blog. #TruffleSecurity #Trufflehog #DevTips