Posts tagged: Secure by Design

This tag lists the series newest-first. For the full roadmap — 36 posts across 12 series, in reading order, mapped to OWASP and CySA+ — see the Secure by Design front page.

← View all posts

XXE and XML Bombs: Why You Should Think Twice Before Parsing XML in Python

Published May 21, 2026 • Updated September 13, 2026 • Cybersecurity Django OWASP Python Secure by Design Web Security

XXE in Django: how external entities read files and reach the metadata endpoint, Billion Laughs exhausts memory, and defusedxml is the fix. OWASP A02.

OS Command Injection: subprocess, os.system and the Dangers of Shell=True

Published May 14, 2026 • Updated September 14, 2026 • Cybersecurity Django OWASP Python Secure by Design Web Security

OS Command Injection in Django: how shell=True turns user input into RCE, why shell=False with an argument list stops it. OWASP A05, CVE-2016-3714.

Server-Side Template Injection (SSTI): When Django Templates Become a Weapon

Published May 11, 2026 • Updated September 13, 2026 • Cybersecurity Django OWASP Python Secure by Design Web Security

SSTI in Django: how Jinja2 MRO traversal achieves RCE, why Django's DTL is safe by design, and where that guarantee evaporates. OWASP A05, CVE-2022-22954.

Cross-Site Scripting (XSS): Stored, Reflected and DOM-Based Attacks — and Why mark_safe and Unsafe Markdown Are Equally Dangerous

Published May 7, 2026 • Updated September 13, 2026 • Cybersecurity Django OWASP Python Secure by Design Web Security

XSS in Django: how stored, reflected and DOM-based attacks work, why mark_safe() and unsafe Markdown open the same hole, and how to migrate to nh3.

SQL Injection: How Attackers Break Your Database and How Django's ORM Stops Them

Published May 4, 2026 • Updated September 13, 2026 • Cybersecurity Django OWASP Secure by Design SQL Injection Web Security

SQL Injection: how attackers exploit unsanitised queries, why Django's ORM stops them, and where the protection ends. OWASP A05, CySA+ VM.

« first previous Page 2 of 2