> Markdown version of [/videos/414-101-typical-security-pitfalls?t=478](https://www.wearedevelopers.com/videos/414-101-typical-security-pitfalls?t=478). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# 101 Typical Security Pitfalls

Are you trusting your frontend to protect your backend? Uncover five typical security pitfalls—from XSS bypasses to low-level memory leaks—that leave your software open to devastating attacks.

- **Speakers:** Alexander Pirker
- **Event:** World Congress 2022
- **Published:** June 15, 2022
- **Duration:** 28:41
- **URL:** https://www.wearedevelopers.com/videos/414-101-typical-security-pitfalls

## Summary

Developers often overestimate their application's security posture, mistakenly believing their backend code is protected by frontend controls or default frameworks. As highlighted by high-profile vulnerabilities like Log4Shell and Spring4Shell, attackers can easily bypass superficial defenses to exploit core systems. This technical overview breaks down five typical security pitfalls spanning from web architectures to low-level cryptographic implementations, demonstrating how relying on assumed constraints leaves software completely exposed.

A primary vulnerability is cross-site scripting (XSS) caused by frontend security bypasses; treating the UI as a sufficient barrier allows attackers to inject malicious HTML directly into the database via direct endpoint calls. Using a backend HTML sanitizer like DOMPurify is critical to mitigating this risk. The discussion then moves into remote code execution (RCE) scenarios resulting from passing insufficiently validated inputs into backend subprocess operations, a flaw that can easily expose server command-lines. Furthermore, in languages like Go, missing boundary checks on incoming data lengths—like expected cryptographic key sizes—can lead to unhandled system panics, generating an immediate denial of service (DoS) vector as vital microservices crash completely.

Diving into low-level memory vulnerabilities common in C and C++, the talk explores how careless type casting—specifically downcasting integers—causes critical cryptographic failures. For instance, in an implementation of Shamir's Secret Sharing, downcasting an out-of-range user index silently creates colliding cryptographic shares. Similarly, failing to validate data offsets allows out-of-bounds memory copy operations to read hidden stack memory, leaking sensitive passwords or keys analogous to the Heartbleed flaw. Ultimately, fortifying software requires continuous backend input validation, vigilant type handling, explicit memory boundary enforcement, and global error recovery handlers to secure systems against unpredictable manipulation.

**Keywords:** cross-site scripting, frontend security bypass, backend input validation, remote code execution, denial of service, go panic handling, c++ downcast vulnerabilities, memory out-of-bounds read, dompurify, html sanitization, subprocess command injection, log4shell, shamir's secret sharing, cryptographic key leakage, global error recovery, type casting errors

## Chapters

1. **Assessing the real state of application security** (00:05) — System vulnerabilities often remain hidden until an attacker finds a way to bypass outer defenses.
1. **Contextual factors determining software security requirements** (01:31) — Security needs vary drastically based on application type, deployment environment, data sensitivity, and performance constraints.
1. **Real-world impact of remote code execution vulnerabilities** (02:44) — Severe flaws like log4shell and spring4shell demonstrate why robust application security must be integrated initially.
1. **Overview of five common software security pitfalls** (04:03) — A structured examination of critical vulnerabilities spanning from frontend bypasses to out-of-bounds memory reading.
1. **Preventing cross-site scripting through backend data sanitization** (04:52) — Relying solely on frontend HTML sanitizers leaves systems exposed to malicious payloads sent directly via curl.
1. **Avoiding remote code execution from unsanitized inputs** (07:58) — Failing to validate command line parameters enables attackers to inject secondary commands and open reverse shells.
1. **Mitigating denial of service attacks from application crashes** (11:51) — Checking cryptographic key lengths prevents unexpected language panics from permanently crashing crucial microservices.
1. **Fixing broken cryptography caused by integer downcasting** (16:06) — Passing oversized index values into smaller integer types causes modular arithmetic overlap and severe data leakage.
1. **Preventing information leakage from out-of-bounds memory reads** (20:35) — Validating array index requests ensures memory-copy operations cannot extract adjacent sensitive data from the stack.
1. **Core principles for input validation and memory safety** (24:40) — Strict input sanitization, careful data type casting, and proactive memory management form the foundation of secure software.
1. **Selecting robust tools for backend HTML sanitization** (27:33) — Implementing tools like dompurify on the backend effectively neutralizes prevalent cross-site scripting threats before database storage.

## Related Moments

- [Using intentionally vulnerable applications for practical security training](https://www.wearedevelopers.com/videos/1829-how-to-defend-against-data-manipulation-attacks-bozidar-spirovski-wekoslav-stefanovski) (from "How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski")
- [Answering audience questions on practical application security](https://www.wearedevelopers.com/videos/220-software-security-101-secure-coding-basics) (from "Software Security 101: Secure Coding Basics")
- [Understanding software vulnerabilities and prominent exploits](https://www.wearedevelopers.com/videos/100235-beyond-sboms-the-future-of-container-supply-chain-security) (from "Beyond SBOMs: The Future of Container Supply Chain Security")
- [Identifying common and emerging application injection attack vectors](https://www.wearedevelopers.com/videos/1829-how-to-defend-against-data-manipulation-attacks-bozidar-spirovski-wekoslav-stefanovski) (from "How to Defend Against Data Manipulation Attacks - Bozidar Spirovski & Wekoslav Stefanovski")
- [Addressing developer adoption and future software security risks](https://www.wearedevelopers.com/videos/900-from-syntax-to-singularity-ai-s-impact-on-developer-roles) (from "From Syntax to Singularity: AI’s Impact on Developer Roles")
- [Identifying non-coding software vulnerabilities and organizational risks](https://www.wearedevelopers.com/videos/712-unleashing-the-power-of-developers-why-cybersecurity-is-the-missing-piece) (from "Unleashing the Power of Developers: Why Cybersecurity is the Missing Piece?!?")

## Related Articles

- [Understanding and Mitigating Common Web Vulnerabilities](https://www.wearedevelopers.com/magazine/565-understanding-and-mitigating-common-web-vulnerabilities)
- [Walking Into The Era of Supply Chain Risks](https://www.wearedevelopers.com/magazine/106-walking-into-the-era-of-supply-chain-risks)
- [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing)
- [Dev Digest 138 - Are you secure about this?](https://www.wearedevelopers.com/magazine/486-dev-digest-138-are-you-secure-about-this)

## Related Jobs

- [Engineer, Offensive Security Organization](https://www.wearedevelopers.com/jobs/ext/1992296-engineer-offensive-security-organization) at **Twilio**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Principal Software Engineer, Identity](https://www.wearedevelopers.com/jobs/ext/1469181-principal-software-engineer-identity) at **GitHub**
- [Software Engineer II, Security](https://www.wearedevelopers.com/jobs/ext/131510-software-engineer-ii-security) at **GitHub**
- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**
- [Penetration Tester / Red team Specialist](https://www.wearedevelopers.com/jobs/ext/293774-penetration-tester-red-team-specialist) at **Raiffeisen Bank International AG**