YAML
Environment Variable Substitution in YAML Config Files
Substitute environment variables into YAML config after parsing, not before. Expanding text first broke on a colon and hash; a typed walk kept the value.
6 min read
Tag
security
43 posts
ExcelGuide
A Practical Guide to Connecting Excel Directly to a Database
Connect Excel to PostgreSQL, MySQL and SQL Server with connectors and ODBC, using read only accounts, parameters, safe credentials, refresh and speed checks.
16 min read
CSV
Detecting Encoded Payloads Hidden in CSV Fields Fast
A short Python scanner that flags base64 blobs, percent-encoded text, script tags, formula starts and oversized fields in a CSV before you import it.
6 min read
CSV
Sending a CSV by Email Safely and the Better Options
Email is a poor way to move a CSV of real data. Ranked alternatives, from not sending it to expiring links, plus how to encrypt a file you must attach.
6 min read
CSV
Handling CSV Files Full of Customer Data Under GDPR
The GDPR duties that land on a CSV of customer data, from minimization and retention to access requests and deletion, turned into practical engineering steps.
7 min read
CSV
Limiting File Size and Row Count for CSV Uploads Safely
Pick CSV upload limits from measured parse and load speed, enforce each where it is cheapest, and reject bad shapes with a script that names the line.
7 min read
JSONGuide
JSON Security Mistakes in Apps and Pipelines and Their Fixes
A tested guide to JSON security: where bodies turn hostile, parser differences, prototype pollution, SQL, limits, numbers, logs, and a checklist.
18 min read
CSV
Hashing or Masking Columns in a CSV Safely Without Leaks
A plain SHA-256 of an email is reversible with a guess list. Use a keyed HMAC for tokens and partial masking for display, with a script that does both.
7 min read
CSV
Stripping Personal Data From a CSV Before Sharing It
Remove, generalize and pseudonymize the personal columns of a CSV with DuckDB before it leaves your team, then check that no one can still be singled out.
7 min read
CSV
Why a Hostile CSV Upload Can Hurt Your Application Server
A CSV upload needs no exploit to take a server down: compressed bombs, one huge field, an unclosed quote and wide files, each with the limit that stops it.
7 min read
CSV
Escaping Formula Characters in a CSV Export Safely
A small function that neutralizes formula triggers in CSV text cells, why negative numbers must be exempt, and a test table to keep the fix from regressing.
7 min read
CSV
CSV Injection and How Formulas in a Cell Become an Attack
How a name starting with an equals sign turns your CSV export into an attack on whoever opens it, what payloads do, and how to test your own exports.
7 min read