> Markdown version of [/videos/1829-how-to-defend-against-data-manipulation-attacks-bozidar-spirovski-wekoslav-stefanovski?t=151](https://www.wearedevelopers.com/videos/1829-how-to-defend-against-data-manipulation-attacks-bozidar-spirovski-wekoslav-stefanovski?t=151). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski

Are you blindly trusting your dependencies? Discover why shipping MVPs leaves your infrastructure vulnerable, and learn how to break your systems before attackers do.

- **Speakers:** Bozidar Spirovski, [Wekoslav Stefanovski](https://www.wearedevelopers.com/@wekoslav-stefanovski)
- **Event:** Coffee With Developers
- **Published:** March 4, 2026
- **Duration:** 38:44
- **URL:** https://www.wearedevelopers.com/videos/1829-how-to-defend-against-data-manipulation-attacks-bozidar-spirovski-wekoslav-stefanovski

## Summary

Bozidar Spirovski and Wekoslav Stefanovski explore the persistent disconnect between security professionals and developers, highlighting how the pressure to ship MVPs often leaves foundational vulnerabilities in production environments. As new tools and AI assistants accelerate development, engineers increasingly adopt temporary architectural shortcuts and place blind trust in dependencies, which inevitably become permanent security liabilities. Rather than relying on magical safeguards like ORMs or automated filters, true security requires a shift in mindset and direct developer engagement with threat vectors. At the technical level, the conversation unpacks evolving data manipulation attacks, moving beyond classic SQL and cross-site scripting to address modern infrastructure weaknesses. Key attack vectors include server-side request forgery (SSRF) in microservices—where exposed metadata servers offer direct cloud compromise—and application-level denial-of-service attacks caused by overloaded JWT and cookie validation. Additionally, the speakers warn of command injection via system binaries and software supply chain poisoning through AI-hallucinated NPM and PyPI packages. Ultimately, passive compliance and predictable password rotations provide false comfort. The most effective defense strategy involves intentionally destructive, hands-on learning by deploying purposely vulnerable ecosystems. By forcing developers to exploit their own contextual misconfigurations, organizations foster a deeper awareness of security boundaries, establishing a culture where teams break their own systems so that attackers will not.

**Keywords:** data manipulation attacks, sql injection vulnerabilities, server-side request forgery, jwt validation overload, command injection boundaries, microservice metadata risks, supply chain poisoning, ai code hallucination, secure development lifecycle, vulnerable test environments, testing in production risks, hardcoded secret management, npm package spoofing, cookie token manipulation

## Chapters

1. **Bridging the gap between developers and security tools** (00:01) — A security professional and a developer discuss ways to align their respective workflows for building safer products.
1. **Identifying common and emerging application injection attack vectors** (02:31) — Understanding why vulnerabilities ranging from legacy database queries to modern text prompt manipulations persistently occur.
1. **Exploiting cloud metadata servers and manipulating authentication tokens** (05:27) — How unchecked server requests can expose system metadata and overload application authentication services across cloud architectures.
1. **Using intentionally vulnerable applications for practical security training** (09:40) — An overview of how a custom sandbox environment provides safe, hands-on practice identifying logic and application flaws.
1. **Avoiding supply chain risks within standard software dependencies** (14:28) — Recognizing hidden threats located inside widely adopted package managers and binary compilation tools.
1. **Compromising default application security through rapid development cycles** (15:45) — The dangers of prioritizing immediate functionality and minimum viable products over fundamental infrastructure testing.
1. **Establishing safe access controls for automated intelligence agents** (19:04) — Why granting excessive system permissions to automated language tools introduces severe operational unpredictability.
1. **Integrating fundamental security evaluations into agile development sprints** (21:42) — How relying on temporary code segments that bypass strict testing creates profound, long-term deployment vulnerabilities.
1. **Overcoming magical thinking regarding third-party software library security** (24:31) — Improving infrastructure defenses requires fundamentally questioning the out-of-the-box safety guarantees declared by external deployment dependencies.
1. **Diagnosing recurring credential management failures within production environments** (29:44) — Auditing enterprise configurations consistently reveals mistakes involving static repository secrets and mathematically predictable rotation formulas.
1. **Prioritizing thoughtful software development over immediate technology adoption** (36:08) — A concluding reminder to evaluate long-term potential system impacts rather than blindly integrating unverified trending technologies.

## Related Moments

- [Identifying command injection flaws in developer infrastructures](https://www.wearedevelopers.com/videos/346-stranger-danger-your-java-attack-surface-just-got-bigger) (from "Stranger Danger: Your Java Attack Surface Just Got Bigger")
- [Top security vulnerabilities for AI applications](https://www.wearedevelopers.com/videos/1637-delay-the-ai-overlords-how-oauth-and-openfga-can-keep-your-ai-agents-from-going-rogue) (from "Delay the AI Overlords: How OAuth and OpenFGA Can Keep Your AI Agents from Going Rogue")
- [Understanding common web application vulnerabilities and risks](https://www.wearedevelopers.com/videos/724-security-in-modern-web-applications-owasp-to-the-rescue) (from "Security in modern Web Applications - OWASP to the rescue!")
- [The necessity of developer intelligence amidst automated attack generation](https://www.wearedevelopers.com/videos/1004-let-s-write-an-exploit-using-ai) (from "Let’s write an exploit using AI")
- [Improving developer education with realistic security training environments](https://www.wearedevelopers.com/videos/1450-how-github-secures-open-source) (from "How GitHub secures open source")
- [Identifying sophisticated supply chain attacks and simulated software vulnerabilities](https://www.wearedevelopers.com/videos/1859-things-you-don-t-know-about-cookies-and-how-to-protect-them-mohamed-shiralizadeh) (from "Things You Don't Know About Cookies and How to Protect Them - Mohamed Shiralizadeh")

## Related Articles

- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)

## Related Jobs

- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Security Architect - AI](https://www.wearedevelopers.com/jobs/ext/1581899-security-architect-ai) at **ZEISS Group**
- [Penetration Tester / Red team Specialist](https://www.wearedevelopers.com/jobs/ext/293774-penetration-tester-red-team-specialist) at **Raiffeisen Bank International AG**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Staff Engineer - Offensive Security](https://www.wearedevelopers.com/jobs/ext/1226927-staff-engineer-offensive-security) at **Twilio**