Alexander Pirker

101 Typical Security Pitfalls

A number like 257 silently becomes 1, breaking your cryptography and leaking secrets. Discover the subtle dangers of implicit type casting.

101 Typical Security Pitfalls
#1about 3 minutes

Defining the context of application security

Security is not absolute and must be evaluated based on the application type, environment, data sensitivity, and performance constraints.

#2about 2 minutes

Understanding the impact of major vulnerabilities

Recent widespread vulnerabilities like Log4Shell and Spring4Shell demonstrate the critical need for proactive security in software development.

#3about 3 minutes

Preventing XSS by sanitizing on the backend

Client-side input sanitization is easily bypassed, so all user-provided data must be sanitized on the backend to prevent XSS attacks.

#4about 4 minutes

Preventing remote code execution from poor input validation

Failing to validate input parameters against an allowlist can lead to command injection, allowing an attacker to open a reverse shell.

#5about 4 minutes

Preventing denial of service attacks from service crashes

Supplying malformed data, like a public key of the wrong length, can trigger a panic in a library and cause a denial-of-service attack.

#6about 4 minutes

How data type downcasting can break cryptography

Implicitly downcasting a larger integer to a smaller type like a byte can lead to information leakage by causing index collisions.

#7about 4 minutes

Preventing information leakage from out-of-bounds memory reads

Failing to validate the length parameter in a memory copy operation can lead to an out-of-bounds read, leaking sensitive stack memory.

#8about 3 minutes

Four key principles for writing secure code

Developers should prioritize input data sanitation, careful data type selection, proper memory management, and graceful error handling.

#9about 1 minute

Q&A on common pitfalls and sanitization tools

The most common security pitfall is XSS from frontend bypasses, and DOMPurify is a recommended tool for HTML sanitization.

Related jobs
Jobs that call for the skills explored in this talk.

Matching moments

Selecting strategic partners and essential event tools
03:17 MIN

Selecting strategic partners and essential event tools

Cat Herding with Lions and Tigers - Christian Heilmann

Organizing a developer conference for 15,000 attendees
01:32 MIN

Organizing a developer conference for 15,000 attendees

Cat Herding with Lions and Tigers - Christian Heilmann

Using content channels to build an event community
04:49 MIN

Using content channels to build an event community

Cat Herding with Lions and Tigers - Christian Heilmann

Establishing a single source of truth for all data
02:39 MIN

Establishing a single source of truth for all data

Cat Herding with Lions and Tigers - Christian Heilmann

Increasing the value of talk recordings post-event
04:57 MIN

Increasing the value of talk recordings post-event

Cat Herding with Lions and Tigers - Christian Heilmann

Balancing the trade-off between efficiency and resilience
03:38 MIN

Balancing the trade-off between efficiency and resilience

What 2025 Taught Us: A Year-End Special with Hung Lee

Why HR struggles with technology implementation and adoption
04:22 MIN

Why HR struggles with technology implementation and adoption

What 2025 Taught Us: A Year-End Special with Hung Lee

Developing resilience by expanding your capacity for failure
04:57 MIN

Developing resilience by expanding your capacity for failure

What 2025 Taught Us: A Year-End Special with Hung Lee

Featured Partners

Related Videos

See all videos
Programming secure C#/.NET Applications: Dos & Don'ts33:29

Programming secure C#/.NET Applications: Dos & Don'ts

Sebastian Leuer

Cross Site Scripting is yesterday's news, isn't it?30:54

Cross Site Scripting is yesterday's news, isn't it?

Martina Kraus

Security Pitfalls for Software Engineers27:32

Security Pitfalls for Software Engineers

Jasmin Azemović

Security in modern Web Applications - OWASP to the rescue!26:59

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

You click, you lose: a practical look at VSCode's security29:47

You click, you lose: a practical look at VSCode's security

Thomas Chauchefoin & Paul Gerste

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks27:10

Hack-Proof The Node.js runtime: The Mechanics and Defense of Path Traversal Attacks

Sonya Moisset

Typed Security: Preventing Vulnerabilities By Design58:19

Typed Security: Preventing Vulnerabilities By Design

Michael Koppmann

Software Security 101: Secure Coding Basics1:58:48

Software Security 101: Secure Coding Basics

Thomas Konrad

Related Articles

View all articles
DC
Daniel Cranney
Dev Digest 198: 30 years of JS, In-Browser AI, How Attackers Abuse GenAI
Inside last week’s Dev Digest 198 . 🎂 30 years of JavaScript ⏰ How long is a JavaScript second 💻 Clean code in Angular 🤦‍♂️ AI makes different mistakes than humans 👨‍💻 In-browser and offline AI 🟠 Undocumented Hacker News features 🐋 DeepSeek censored...
Dev Digest 198: 30 years of JS, In-Browser AI, How Attackers Abuse GenAI
DC
Daniel Cranney
Dev Digest 196: AI Killed DevOps, LLM Political Bias & AI Security
Inside last week’s Dev Digest 196 . ⚖️ Political bias in LLMs 🫣 AI written code causes 1 in 5 security breaches 🖼️ Is there a limit to alternative text on images? 📝 CodeWiki - understand code better 🟨 Long tasks in JavaScript 👻 Scare yourself into n...
Dev Digest 196: AI Killed DevOps, LLM Political Bias & AI Security

From learning to earning

Jobs that call for the skills explored in this talk.