shehackspurple
Re:(Gated) Secure Coding AI Prompt Library
on Saturday April 18, 2026 @03:04PM (#47818534)
Free AI prompt library, gated though
The Psychology of Bad Code Part 3 – Vibe Coding
Re:The Psychology of Bad Code Part 3 – Vibe Coding
on Thursday February 19, 2026 @05:26PM (#47080527)
This seems like rational behavior for a high-pressure situation. You might do this. I might do this too. But it causes risk.
Secure Coding Peitition for the Government of Canada
Re:Secure Coding Peitition for the Government of Canada
on Friday January 30, 2026 @03:04PM (#46829121)
Tanya Janca | Shehackspurple
@shehackspurple
·
Jan 27
I’ve been working toward this for years, and it finally happened.
Canada now has a parliamentary petition to require secure coding in federal software. If you care about cybersecurity, public safety, and better government tech, please sign.
Re:The Psychology of Bad Code Part 2 – Building Systems That Support S...
on Friday January 09, 2026 @03:17PM (#46558748)
Why can’t people just “do the right thing” all the time? Can’t they just try hard, have some willpower, and behave perfectly? I don’t know about you, but I am certainly not perfect all the time. I’m in a rush. I skip steps. It compiles, so I commit. We are not robots, we are human beings, and we have a lot going on. But…. There’s more.
The Psychology of Bad Code Part 2 – Building Systems That Support Secure Devs
Re:"It Works on My Machine": The Psychology of Bad Code
on Friday November 28, 2025 @02:29PM (#46081948)
What if insecure code is not a result of laziness, a lack of knowledge, or malice? What if software developers are doing their best, but they have been set up to fail?
"It Works on My Machine": The Psychology of Bad Code
The New 2025 OWASP Top Ten
Re:Malicious packages in NPM evade dependency detection through invisi...
on Friday October 31, 2025 @02:54PM (#45775406)
More terrifying supply chain attacks against developers
Malicious packages in NPM evade dependency detection through invisible URL links
Re:Secure Coding in JavaScript
on Friday October 24, 2025 @02:18PM (#45697529)
Over 30 practical tips for writing more secure JavaScript!
Secure Coding in JavaScript
What Is Threat Modeling?
Re:What Is Threat Modeling?
on Friday August 29, 2025 @02:54PM (#45067981)
Threat modeling is really just a fancy way of saying: “Let’s think about what could go wrong with our software in advance, so we can stop it before it happens.”
A brief intro to threat modeling
Re:Petition to Adopt a Federal Secure Coding Policy for Canada
on Saturday July 26, 2025 @05:07PM (#44696927)
Canada’s digital software is critical infrastructure. It runs our country, and we depend upon it. Let's protect it with a secure coding policy, now.
Petition to Adopt a Federal Secure Coding Policy for Canada
Petition for a secure coding policy for Canada
Re:Petition for a secure coding policy for Canada
on Friday July 04, 2025 @03:55PM (#44467381)
I've created a petition to try to get Canada to adopt a government-wide secure coding policy. If you are Canadian, please consider signing.
An Application Security Survey to improve your program
This survey will help you mature your AppSec Program. Fill it out, then (for free) receive targeted advice to mature your program.
Re:Free Secure Coding Guidelines (Language-Agnostic, Actionable, Achie...
on Friday April 25, 2025 @01:27PM (#43796320)
I just published a 9-page secure coding guideline that’s free to download when you join my newsletter. It’s based on my book Alice and Bob Learn Secure Coding, but distilled down into practical, achievable advice.
Language and framework agnostic
Focused on real-world, actionable practices
Designed to be clear, not overwhelming
My goal was to make something that developers can actually use, not just read once and forget. I’d love feedback from the HN community—what's missing? What’s useful?
Free Secure Coding Guidelines (Language-Agnostic, Actionable, Achievable
Free Course on Security Headers, for Developers
Re:Free Course on Security Headers, for Developers
on Thursday April 24, 2025 @04:23PM (#43787088)
This is a free course about how to implement security headers in Web Apps and why they are so incredibly important!
Re:Ask HN: What is the best DAST/web app scanner for single page web a...
on Wednesday January 19, 2022 @02:54PM (#29999100)
Thanks for all the details! Anyone else?
Re:1Password Has Raised $620M
on Wednesday January 19, 2022 @12:43PM (#29997039)
Congratulations 1Password! AMAZING
Ask HN: What is the best DAST/web app scanner for single page web apps?
#AskHN What is the best DAST/web app scanner for single page/dynamic/super-modern web apps? Apps totally written in javascript. And WHY? Specifically what about it makes it best? Most of them are "not great", I want to know which ones are really good. Thanks!